Disabling Legacy Authentication in Exchange Server 2019

Published Jun 21 2019 08:53 AM 33.7K Views

We are happy to announce our work to allow you to disable legacy authentication is available to you with the second cumulative update (CU2) for Exchange 2019. This provides an important step down the path of removing legacy authentication mechanisms from Exchange Hybrid deployments.

This feature is very similar to the functionality offered in Office 365 for Disabling Basic authentication.

Why is this feature important?

As you probably know, legacy authentication methods are less secure, are vulnerable to interception and are susceptible to brute-force and password spray attacks. If your organization has no legacy email clients or doesn’t want to allow legacy email clients, you can use these new Authentication Policies in your Exchange Hybrid environment to disable legacy authentication requests. This ensures only those clients that support Hybrid Modern Authentication can connect to Exchange Server.

What are ‘legacy’ authentication methods?

Exchange Server has been around for 23 years, so we’ve seen a lot of change over that time. We’ve had to support multiple authentication methods over this time, to keep in sync with clients and to allow simple migration. The following legacy authentication methods have historically been used to access Exchange servers, and it’s the removal of these were are interested in for the purposes of this feature and post.

  • Basic authentication
  • Digest authentication
  • Windows authentication (NTLM and Kerberos)

So what do you need to do to configure this new feature?

Pre-requisites

  1. Verify that Hybrid Modern Authentication is enabled and successfully working in your Exchange Hybrid environment.
  2. Verify that all of your email clients and apps support Modern Authentication. Clients that currently support Hybrid Modern Auth are listed below. It’s also really important to keep your clients up to date – no only does that ensure they get fixes for any issues we find, but it means they get the latest features and capabilities too.
  • Outlook 2013 or later (Outlook 2013 requires a registry key change)
  • Outlook 2016 for Mac or later
  • Outlook for iOS and Android
  • Mail for iOS 11.3.1 or later

Authentication Policies

You block legacy authentication in Exchange hybrid environments by creating authentication policies. Authentication policies define the client protocols where legacy authentication is blocked (all protocols or specific protocols, although we typically recommend blocking legacy authentication for all protocols).

After you create authentication policies, you assign them to users. Assigning a policy to users blocks their legacy authentication requests for the specified protocols. Note that for the policy to take effect, mailboxes must be on an Exchange 2019 CU2 server and connection to the mailbox cannot come through an older version of Exchange.

You manage all aspects of authentication policies in the Exchange Management Shell.

Supported Protocols and Services

The protocols and services in Exchange that you can block legacy authentication for are described in the following table.

Protocol or service

Description

Parameter name

Exchange Active Sync (EAS)

Used by some email clients on mobile devices.

BlockLegacyAuthActiveSync

Autodiscover

Used by Outlook and EAS clients to find and connect to mailboxes in Exchange

BlockLegacyAuthAutodiscover

IMAP

Used by IMAP email clients.

BlockLegacyAuthImap

MAPI over HTTP (MAPI/HTTP)

Used by Outlook 2013 and later.

BlockLegacyAuthMapi

Offline Address Book (OAB)

A copy of address list collections that are downloaded and used by Outlook.

BlockLegacyAuthOfflineAddressBook

POP3

Used by POP email clients.

BlockLegacyAuthPop

Outlook Anywhere (RPC over HTTP)

Used by Outlook 2016 and earlier.

BlockLegacyAuthRpc

Exchange Web Services (EWS)

A programming interface that’s used by Outlook, Outlook for Mac, and third-party apps.

BlockLegacyAuthWebServices

Typically, when you block legacy authentication for a user, we recommend that you block legacy authentication for all protocols. However, you can use the BlockLegacyAuth* parameters (switches) on the New-AuthenticationPolicy and Set-AuthenticationPolicy cmdlets to selectively allow or block legacy authentication for specific protocols.

Step 1: Create the Authentication Policy

To create a policy that blocks legacy authentication for the specified client protocol, use the New-AuthenticationPolicy cmdlet.

This example creates an authentication policy named “Block Legacy Auth” to block legacy authentication for all client protocols in Exchange 2019 (the recommended configuration).

 

New-AuthenticationPolicy -Name "Block Legacy Auth" -BlockLegacyAuthActiveSync -BlockLegacyAuthAutodiscover -BlockLegacyAuthImap -BlockLegacyAuthMapi -BlockLegacyAuthOfflineAddressBook -BlockLegacyAuthPop -BlockLegacyAuthRpc -BlockLegacyAuthWebServices

Step 2: Assign the authentication policy to users

The methods that you can use to assign authentication policies to users are:

Individual user accounts:

This example assigns the policy named Block Legacy Auth to the user account laura@contoso.com.

Set-User -Identity laura@contoso.com -AuthenticationPolicy "Block Legacy Auth"

Filter user accounts by attributes: This method requires that the user accounts all share a unique filterable attribute (for example, Title or Department) that you can use to identify the users.

This example assigns the policy named Block Legacy Auth to all user accounts whose Title attribute contains the value “Sales Associate”.

 

$SalesUsers = Get-User -ResultSize unlimited -Filter {(RecipientType -eq 'UserMailbox') -and (Title -like '*Sales Associate*')}
$Sales = $SalesUsers.SamAccountName
$Sales | foreach {Set-User -Identity $_ -AuthenticationPolicy "Block Legacy Auth"}

Use a list of specific user accounts: This method requires a text file to identify the user accounts. Values that don’t contain spaces (for example, the user principal name or UPN) work best. The text file must contain one user account on each line like this:

 

akol@contoso.com
tjohnston@contoso.com
kakers@contoso.com

The syntax uses two commands (one to identify the user accounts, and the other to apply the policy to those users).

This example assigns the policy named Block Legacy Auth to the user accounts specified in the C:\My Documents\BlockLegacyAuth.txt file

 

$BLA = Get-Content "C:\My Documents\BlockLegacyAuth.txt"
$BLA | foreach {Set-User -Identity $_ -AuthenticationPolicy "Block Legacy Auth"}

Configure the default authentication policy

The default authentication policy is assigned to all users who don’t already have a specific policy assigned to them (a directly assigned policy takes precedence).

You can configure the default authentication policy for the organization, using the

Set-OrganizationConfig cmdlet.

This example below configures the authentication policy named “Block Legacy Auth” as the default policy.

 

Set-OrganizationConfig -DefaultAuthenticationPolicy "Block Legacy Auth"

How does this feature work in practice?

The diagrams below illustrate how this feature works once a policy has been created and assigned.

 

 

Hybrid Modern Auth FlowHybrid Modern Auth Flow

 

Legacy Auth FlowLegacy Auth Flow

How do I view authentication policies?

To view a summary list of the names of all existing authentication policies, run the following command:

 

Get-AuthenticationPolicy | Format-Table -Auto Name

To view detailed information about a specific authentication policy, use this syntax:

Get-AuthenticationPolicy -Identity "Block Legacy Auth"

How do I remove authentication policies?

To remove the policy run the following command. Please note that it would take around one hour for policy to be removed after the command is executed.

To remove the policy for a particular user , say userA, use the following command.

 

Set-User userA -AuthenticationPolicy $null

To remove the policy for the Organization level , use the following command.

 

Set-OrganizationConfig -DefaultAuthenticationPolicy $null

Summary

You now have a way to block legacy authentication mechanisms for users in your Organisation so that they all can use Modern Authenticaion . We would love to hear your feedback. Please do leave us comments below.

Thank you,

The Exchange Team

 

41 Comments
New Contributor

We‘d love to see this showing up for all Exchange releases that support Hybrid Modern Auth today - as companies may have reasons not to migrate to 2019 yet due to their Cloud strategy

Any chance we could see this showing up in the 2016 space as well? Thanks guys!

Occasional Contributor
When will we see Modern Authentication on Exchange Server 2019 without cloud (AAD) prerequisites?
New Contributor

@Han Valk: The answer is in the Blog Article about the release of CU2 ;)

Occasional Visitor

I am curious why kerberos is listed as a legacy authentication mechanism, especially why it is deemed unsafe. Are there security considerations concerning kerberos? Has the protocol been hacked or are there client and/or server specific vulnerabilities?

 

Since kerberos is used almost exclusively in an AD domain any vulnerabilities would be of great importance and interest to anybody using Windows in a work environment.

 

Sincerly

Markus

 

@Martin_Aigner  - 2019 only for this feature. 

@MarkusTUD - Kerberos will still be used between servers, but for clients it's much harder to enforce things like MFA and it can't be used from outside the network firewall/edge. So we'd like to get clients off it and onto something better. 

Senior Member

I have a question - why can't we just remove all the other authentication protocols (Basic, NTLM, Windows Integrated etc.) and leave only oAuth from, say from MAPI virtual directory and only enforce HMA for Outlook connection ? 

Because setup, CU's and our cmdlets will keep adding them back - we need some of those for server to server auth. 

Senior Member

Does server to server communication use Basic and NTLM authentication as well ?

Not generally, though MRS based mailbox moves use NTLM. Turning off Basic using the cmdlets if fine imho - but turning off IWA is not. 

Senior Member

@Greg Taylor - EXCHANGE  - Thank you ! 

Occasional Contributor

This is great news, going to look at implementing this.

 

Greg, when you say Exchange continues to leverage NTLM in some places, if one was to implement NTLM blocking using GPO (Network security: Restrict NTLM: NTLM authentication in this domain) this would break Exchange if we have multiple Exchange servers? The goal being to enforce usage of Kerberos instead.

@Mirza Dedic - it wouldn't be supported, and some things might break (MRS based moves to O365 use NTLM, just one example). You can't do Kerberos from outside the firewall either, so if you use Outlook Anywhere, you can't use Kerb for users outside the firewall. 

Senior Member

Hey @Greg Taylor - EXCHANGE , great article. 

When we will see ModernAuth 100% on-premise without hybrid modern authentication requirement?

@Jonathan Santos  - never, we decided to shelve that plan and announced it here - https://techcommunity.microsoft.com/t5/exchange-team-blog/released-june-2019-quarterly-exchange-upda... . Sorry. 

Occasional Contributor

@Greg Taylor - EXCHANGE Can we use this feature by adding some Exchange 2019 servers to our Exchange 2016 environment and then route all incoming traffic like EWS from the internet to these 2019 server to be able to use modern auth and and block legacy auth at the same time?

@®win .  Authentication Policies only apply to mailboxes homed on 2019 as the blog says: "Note that for the policy to take effect, mailboxes must be on an Exchange 2019 CU2 server"

New Contributor

@Greg Taylor - EXCHANGE when I set the policy at the organization level things stop working. Once I execute 

 

Set-OrganizationConfig -DefaultAuthenticationPolicy "Block Legacy Auth"

windows/dialog boxes will start flashing on half of the outlook clients. It flashes fast and I can't tell if there is any content. Also, half the phones will stop working. When I set the authentication policy back to null everything starts working again but legacy auth is still enabled.

 

If I set the authentication policy at the user level things work as you would expect. HMA seems to function just fine on the same outlook clients and phones that have an issue if the policy is set at the org level. 

 

We have a 2 node DAG and we're using roundrobin DNS for load balancing. I'm not 100% but it seems to be that the clients have an issue if they're connecting to the node that doesn't house the database that their mailbox is on. I think? There isn't anything that needs to be done to proxy the modern auth requests between the servers is there?

 

When I enabled the policy at the org level I start seeing unhandled exceptions in the event logs that all seem to point to some kind of duplicate key but I can't figure out what that duplicate key is... any thoughts? Here are some examples from the event log:

 

 

Log Name: Application
Source: MSExchange Front End HTTP Proxy
Event ID: 1003
Task Category: Core
Level: Error
Keywords: Classic
User: N/A
Description:
[Owa] An internal server error occurred. The unhandled exception was: Microsoft.Exchange.Collections.TimeoutCache.DuplicateKeyException: Cannot add a duplicate key. Use Insert instead
at Microsoft.Exchange.Security.Authentication.FederatedAuthService.CacheReader.AddEntry(String userKey, Int32 userPolicy, ConfigWrapper config)
at Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyRepo.GetUserPolicy(String userKey, Int32 traceId, Int32& userPolicy, HttpApplication httpApplication, IRecipientSession recipientSession, IConfigurationSession configSession, ConfigWrapper config)
at Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyEvaluator.IsBasicAuthAllowed(String userKey, String protocolName, Int32 traceId, HttpApplication httpApplication, IRecipientSession recipientSession, IConfigurationSession configSession, ConfigWrapper config)
at Microsoft.Exchange.HttpProxy.ProxyModule.IsLegacyAuthAllowed(HttpApplication httpApplication)
at Microsoft.Exchange.HttpProxy.ProxyModule.OnPostAuthenticateInternal(HttpApplication httpApplication)
at Microsoft.Exchange.Common.IL.ILUtil.DoTryFilterCatch(Action tryDelegate, Func`2 filterDelegate, Action`1 catchDelegate)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="MSExchange Front End HTTP Proxy" />
<EventID Qualifiers="49152">1003</EventID>
<Level>2</Level>
<Task>1</Task>
<Keywords>0x80000000000000</Keywords>
<EventRecordID>861239</EventRecordID>
<Channel>Application</Channel>
<Security />
</System>
<EventData>
<Data>Owa</Data>
<Data>Microsoft.Exchange.Collections.TimeoutCache.DuplicateKeyException: Cannot add a duplicate key. Use Insert instead
at Microsoft.Exchange.Security.Authentication.FederatedAuthService.CacheReader.AddEntry(String userKey, Int32 userPolicy, ConfigWrapper config)
at Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyRepo.GetUserPolicy(String userKey, Int32 traceId, Int32&amp; userPolicy, HttpApplication httpApplication, IRecipientSession recipientSession, IConfigurationSession configSession, ConfigWrapper config)
at Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyEvaluator.IsBasicAuthAllowed(String userKey, String protocolName, Int32 traceId, HttpApplication httpApplication, IRecipientSession recipientSession, IConfigurationSession configSession, ConfigWrapper config)
at Microsoft.Exchange.HttpProxy.ProxyModule.IsLegacyAuthAllowed(HttpApplication httpApplication)
at Microsoft.Exchange.HttpProxy.ProxyModule.OnPostAuthenticateInternal(HttpApplication httpApplication)
at Microsoft.Exchange.Common.IL.ILUtil.DoTryFilterCatch(Action tryDelegate, Func`2 filterDelegate, Action`1 catchDelegate)</Data>
</EventData>
</Event>
Log Name:      Application
Source:        MSExchange Autodiscover
Event ID:      1
Task Category: Web
Level:         Error
Keywords:      Classic
User:          N/A
Description:
Unhandled Exception "Cannot add a duplicate key.  Use Insert instead"
Stack trace:    at Microsoft.Exchange.Security.Authentication.FederatedAuthService.CacheReader.AddEntry(String userKey, Int32 userPolicy, ConfigWrapper config)
   at Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyRepo.GetUserPolicy(String userKey, Int32 traceId, Int32& userPolicy, HttpApplication httpApplication, IRecipientSession recipientSession, IConfigurationSession configSession, ConfigWrapper config)
   at Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyEvaluator.IsBasicAuthAllowed(String userKey, String protocolName, Int32 traceId, HttpApplication httpApplication, IRecipientSession recipientSession, IConfigurationSession configSession, ConfigWrapper config)
   at Microsoft.Exchange.Security.Authentication.BackendRehydrationModule.IsLegacyAuthAllowed(HttpContext httpContext)
   at Microsoft.Exchange.Security.Authentication.BackendRehydrationModule.OnAuthenticateRequest(Object source, EventArgs args)
   at System.Web.HttpApplication.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
   at System.Web.HttpApplication.ExecuteStepImpl(IExecutionStep step)
   at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="MSExchange Autodiscover" />
    <EventID Qualifiers="49152">1</EventID>
    <Level>2</Level>
    <Task>2</Task>
    <Keywords>0x80000000000000</Keywords>
    <EventRecordID>861169</EventRecordID>
    <Channel>Application</Channel>
    <Security />
  </System>
  <EventData>
    <Data>Cannot add a duplicate key.  Use Insert instead</Data>
    <Data>   at Microsoft.Exchange.Security.Authentication.FederatedAuthService.CacheReader.AddEntry(String userKey, Int32 userPolicy, ConfigWrapper config)
   at Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyRepo.GetUserPolicy(String userKey, Int32 traceId, Int32&amp; userPolicy, HttpApplication httpApplication, IRecipientSession recipientSession, IConfigurationSession configSession, ConfigWrapper config)
   at Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyEvaluator.IsBasicAuthAllowed(String userKey, String protocolName, Int32 traceId, HttpApplication httpApplication, IRecipientSession recipientSession, IConfigurationSession configSession, ConfigWrapper config)
   at Microsoft.Exchange.Security.Authentication.BackendRehydrationModule.IsLegacyAuthAllowed(HttpContext httpContext)
   at Microsoft.Exchange.Security.Authentication.BackendRehydrationModule.OnAuthenticateRequest(Object source, EventArgs args)
   at System.Web.HttpApplication.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
   at System.Web.HttpApplication.ExecuteStepImpl(IExecutionStep step)
   at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean&amp; completedSynchronously)</Data>
  </EventData>
</Event>
Log Name:      Application
Source:        MSExchange Front End HTTP Proxy
Event ID:      1003
Task Category: Core
Level:         Error
Keywords:      Classic
User:          N/A
Description:
[Ews] An internal server error occurred. The unhandled exception was: Microsoft.Exchange.Collections.TimeoutCache.DuplicateKeyException: Cannot add a duplicate key.  Use Insert instead
   at Microsoft.Exchange.Security.Authentication.FederatedAuthService.CacheReader.AddEntry(String userKey, Int32 userPolicy, ConfigWrapper config)
   at Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyRepo.GetUserPolicy(String userKey, Int32 traceId, Int32& userPolicy, HttpApplication httpApplication, IRecipientSession recipientSession, IConfigurationSession configSession, ConfigWrapper config)
   at Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyEvaluator.IsBasicAuthAllowed(String userKey, String protocolName, Int32 traceId, HttpApplication httpApplication, IRecipientSession recipientSession, IConfigurationSession configSession, ConfigWrapper config)
   at Microsoft.Exchange.HttpProxy.ProxyModule.IsLegacyAuthAllowed(HttpApplication httpApplication)
   at Microsoft.Exchange.HttpProxy.ProxyModule.OnPostAuthenticateInternal(HttpApplication httpApplication)
   at Microsoft.Exchange.Common.IL.ILUtil.DoTryFilterCatch(Action tryDelegate, Func`2 filterDelegate, Action`1 catchDelegate)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="MSExchange Front End HTTP Proxy" />
    <EventID Qualifiers="49152">1003</EventID>
    <Level>2</Level>
    <Task>1</Task>
    <Keywords>0x80000000000000</Keywords>
    <EventRecordID>861163</EventRecordID>
    <Channel>Application</Channel>
    <Security />
  </System>
  <EventData>
    <Data>Ews</Data>
    <Data>Microsoft.Exchange.Collections.TimeoutCache.DuplicateKeyException: Cannot add a duplicate key.  Use Insert instead
   at Microsoft.Exchange.Security.Authentication.FederatedAuthService.CacheReader.AddEntry(String userKey, Int32 userPolicy, ConfigWrapper config)
   at Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyRepo.GetUserPolicy(String userKey, Int32 traceId, Int32&amp; userPolicy, HttpApplication httpApplication, IRecipientSession recipientSession, IConfigurationSession configSession, ConfigWrapper config)
   at Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyEvaluator.IsBasicAuthAllowed(String userKey, String protocolName, Int32 traceId, HttpApplication httpApplication, IRecipientSession recipientSession, IConfigurationSession configSession, ConfigWrapper config)
   at Microsoft.Exchange.HttpProxy.ProxyModule.IsLegacyAuthAllowed(HttpApplication httpApplication)
   at Microsoft.Exchange.HttpProxy.ProxyModule.OnPostAuthenticateInternal(HttpApplication httpApplication)
   at Microsoft.Exchange.Common.IL.ILUtil.DoTryFilterCatch(Action tryDelegate, Func`2 filterDelegate, Action`1 catchDelegate)</Data>
  </EventData>
</Event>
Log Name:      Application
Source:        ASP.NET 4.0.30319.0
Event ID:      1309
Task Category: Web Event
Level:         Warning
Keywords:      Classic
User:          N/A
Description:
Event code: 3005 
Event message: An unhandled exception has occurred. 
Event ID: f227e48f4d474111873957cee43f41ff 
Event sequence: 2 
Event occurrence: 1 
Event detail code: 0 
 
Application information: 
    Application domain: /LM/W3SVC/2/ROOT/EWS-2-132518667113847979 
    Trust level: Full 
    Application Virtual Path: /EWS 
    Application Path: C:\Program Files\Microsoft\Exchange Server\V15\ClientAccess\exchweb\EWS\ 
 
Process information: 
    Process ID: 12016 
    Process name: w3wp.exe 
    Account name: NT AUTHORITY\SYSTEM 
 
Exception information: 
    Exception type: DuplicateKeyException 
    Exception message: Cannot add a duplicate key.  Use Insert instead
   at Microsoft.Exchange.Security.Authentication.FederatedAuthService.CacheReader.AddEntry(String userKey, Int32 userPolicy, ConfigWrapper config)
   at Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyRepo.GetUserPolicy(String userKey, Int32 traceId, Int32& userPolicy, HttpApplication httpApplication, IRecipientSession recipientSession, IConfigurationSession configSession, ConfigWrapper config)
   at Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyEvaluator.IsBasicAuthAllowed(String userKey, String protocolName, Int32 traceId, HttpApplication httpApplication, IRecipientSession recipientSession, IConfigurationSession configSession, ConfigWrapper config)
   at Microsoft.Exchange.Security.Authentication.BackendRehydrationModule.IsLegacyAuthAllowed(HttpContext httpContext)
   at Microsoft.Exchange.Security.Authentication.BackendRehydrationModule.OnAuthenticateRequest(Object source, EventArgs args)
   at System.Web.HttpApplication.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
   at System.Web.HttpApplication.ExecuteStepImpl(IExecutionStep step)
   at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)


Request information: 
    Request URL: https://<computer name>.<domain>.com:444/EWS/Exchange.asmx 
    Request path: /EWS/Exchange.asmx 
    User host address: <internal IP>
    User: <domain>\<computer name>$ 
    Is authenticated: True 
    Authentication Type: Negotiate 
    Thread account name: NT AUTHORITY\SYSTEM 
 
Thread information: 
    Thread ID: 11 
    Thread account name: NT AUTHORITY\SYSTEM 
    Is impersonating: False 
    Stack trace:    at Microsoft.Exchange.Security.Authentication.FederatedAuthService.CacheReader.AddEntry(String userKey, Int32 userPolicy, ConfigWrapper config)
   at Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyRepo.GetUserPolicy(String userKey, Int32 traceId, Int32& userPolicy, HttpApplication httpApplication, IRecipientSession recipientSession, IConfigurationSession configSession, ConfigWrapper config)
   at Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyEvaluator.IsBasicAuthAllowed(String userKey, String protocolName, Int32 traceId, HttpApplication httpApplication, IRecipientSession recipientSession, IConfigurationSession configSession, ConfigWrapper config)
   at Microsoft.Exchange.Security.Authentication.BackendRehydrationModule.IsLegacyAuthAllowed(HttpContext httpContext)
   at Microsoft.Exchange.Security.Authentication.BackendRehydrationModule.OnAuthenticateRequest(Object source, EventArgs args)
   at System.Web.HttpApplication.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
   at System.Web.HttpApplication.ExecuteStepImpl(IExecutionStep step)
   at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)
 
 
Custom event details: 

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="ASP.NET 4.0.30319.0" />
    <EventID Qualifiers="32768">1309</EventID>
    <Level>3</Level>
    <Task>3</Task>
    <Keywords>0x80000000000000</Keywords>
    <EventRecordID>861141</EventRecordID>
    <Channel>Application</Channel>
    <Security />
  </System>
  <EventData>
    <Data>3005</Data>
    <Data>An unhandled exception has occurred.</Data>
    <Data>f227e48f4d474111873957cee43f41ff</Data>
    <Data>2</Data>
    <Data>1</Data>
    <Data>0</Data>
    <Data>/LM/W3SVC/2/ROOT/EWS-2-132518667113847979</Data>
    <Data>Full</Data>
    <Data>/EWS</Data>
    <Data>C:\Program Files\Microsoft\Exchange Server\V15\ClientAccess\exchweb\EWS\</Data>
    <Data><computer name></Data>
    <Data>
    </Data>
    <Data>12016</Data>
    <Data>w3wp.exe</Data>
    <Data>NT AUTHORITY\SYSTEM</Data>
    <Data>DuplicateKeyException</Data>
    <Data>Cannot add a duplicate key.  Use Insert instead
   at Microsoft.Exchange.Security.Authentication.FederatedAuthService.CacheReader.AddEntry(String userKey, Int32 userPolicy, ConfigWrapper config)
   at Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyRepo.GetUserPolicy(String userKey, Int32 traceId, Int32&amp; userPolicy, HttpApplication httpApplication, IRecipientSession recipientSession, IConfigurationSession configSession, ConfigWrapper config)
   at Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyEvaluator.IsBasicAuthAllowed(String userKey, String protocolName, Int32 traceId, HttpApplication httpApplication, IRecipientSession recipientSession, IConfigurationSession configSession, ConfigWrapper config)
   at Microsoft.Exchange.Security.Authentication.BackendRehydrationModule.IsLegacyAuthAllowed(HttpContext httpContext)
   at Microsoft.Exchange.Security.Authentication.BackendRehydrationModule.OnAuthenticateRequest(Object source, EventArgs args)
   at System.Web.HttpApplication.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
   at System.Web.HttpApplication.ExecuteStepImpl(IExecutionStep step)
   at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean&amp; completedSynchronously)

</Data>
    <Data>https://<computer name>.<domain>.com:444/EWS/Exchange.asmx</Data>
    <Data>/EWS/Exchange.asmx</Data>
    <Data><internal ip></Data>
    <Data><domain>\<computer name>$</Data>
    <Data>True</Data>
    <Data>Negotiate</Data>
    <Data>NT AUTHORITY\SYSTEM</Data>
    <Data>11</Data>
    <Data>NT AUTHORITY\SYSTEM</Data>
    <Data>False</Data>
    <Data>   at Microsoft.Exchange.Security.Authentication.FederatedAuthService.CacheReader.AddEntry(String userKey, Int32 userPolicy, ConfigWrapper config)
   at Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyRepo.GetUserPolicy(String userKey, Int32 traceId, Int32&amp; userPolicy, HttpApplication httpApplication, IRecipientSession recipientSession, IConfigurationSession configSession, ConfigWrapper config)
   at Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyEvaluator.IsBasicAuthAllowed(String userKey, String protocolName, Int32 traceId, HttpApplication httpApplication, IRecipientSession recipientSession, IConfigurationSession configSession, ConfigWrapper config)
   at Microsoft.Exchange.Security.Authentication.BackendRehydrationModule.IsLegacyAuthAllowed(HttpContext httpContext)
   at Microsoft.Exchange.Security.Authentication.BackendRehydrationModule.OnAuthenticateRequest(Object source, EventArgs args)
   at System.Web.HttpApplication.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
   at System.Web.HttpApplication.ExecuteStepImpl(IExecutionStep step)
   at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean&amp; completedSynchronously)
</Data>
  </EventData>
</Event>

@skreel - open a support case. 

New Contributor

@Greg Taylor - EXCHANGE  @The_Exchange_Team I opened a support case. They said they don't have a lot of experience with this... they're currently trying to ascertain if round robin DNS works for this... Should round robin DNS work as a front-end load balancing solution with legacy auth disabled at the org level?

 

I took memory dumps of a couple of the duplicate key exceptions but support says that they can't do anything with the dumps and they don't want them... I tried using windbg and SOS to figure it out on my own but without the symbols or source it's proving to be rather challenging for me... I don't think I'm going to get very far with support. They're saying we might just have to migrate all our mailboxes to the cloud... any help would be appreciated. Thanks!

New Contributor

Exceptions are showing up in the logs located at C:\Program Files\Microsoft\Exchange Server\V15\Logging\HttpProxy\Eas and C:\Program Files\Microsoft\Exchange Server\V15\Logging\HttpProxy\Autodiscover. I have not checked the other HttpProxy logs. Support is saying that no one uses this feature and that it's likely a problem with the code. I've been advised to just not disable legacy auth at the org level on premise and to either move the mailboxes to the cloud or to just disable legacy auth on a per user basis...

@skreel - can you please send me the case number in a private message. Thanks. 

New Contributor

The issue seems to be that when requests are proxied between nodes then legacy authentication needs to be enabled. When you disable legacy auth at the org level it also disables legacy auth for the proxying connection. The solution is to enable legacy auth on the computer accounts of the exchange servers. I wrote up how to do this on my blog. It's a hack though and I doubt it's supported by Microsoft.

@skreel - it's a workaround, but we really need to fix this. I'll keep pushing. 

Senior Member

@skreel Thanks for your contribution.

I was suffering from the same problem, no proxy between servers when default org policy sets to "Block Legacy Auth".
Workaround as suggested on your blog was editing computer auth policy attribute thru ADSI on Exchange Servers computer accounts object, it makes everything working well from client side.
Server side "Unhandled exceptions" keeps appearing to my environment on event viewer.

New Contributor

@bbzome yeah, it seems like this is only a partial workaround. Those unhandled duplicate key exceptions on the server still occur. @Greg Taylor - EXCHANGE do you think it's safe to run with the workaround or should we hold off for an official fix? Thanks!

Honestly, no. That sounds like a bad idea. Your idea of using per-account rather than org settings until we fix it sounds far more sensible. Engineering are looking at it. 

Occasional Visitor

@Greg Taylor - EXCHANGE , we are experiencing the same problem as @skreel. We tested with individual users first and then applied it at the org level and immediately started having the flashing problem and we had to revert and set the default at the org level as $null. We have 3 different DAG's, front ended by Load Balancers. Is the recommendation to still apply it at the user level instead of at the org level?

New Contributor

@cdbrown I haven't heard any guidance otherwise 

The engineering team have agreed to fix this, but it's not going to ship for a CU or two, so until then, stick with per user policies. 

Frequent Visitor

@Greg Taylor - EXCHANGE and @The_Exchange_Team we have enabled HMA and things seems to run good. But when we set authentication policy (pr user) we see some issues with password dialog boxes (Windows login prompt).

We have found out that it is related to BlockLegacyAuthMapi but ONLY if the client is on DirectAccess. If we disconnect DirectAccess everything seems to run smooth as well as if do it from a virtual client not connected to Direct Access.

 

We have 2 Exchange 2019 servers in DAG on CU8 with Big IP F5 loadmaster. 

 

Any suggestions?

@MrKnazure thanks for the feedback. It's been added to the notes for the issue being investigated. 

Occasional Visitor

@Greg Taylor - EXCHANGE If we have all user mailboxes hosted on Exchange 2016, and have deployed Exchange 2019, can we safely enable the default Authentication policy for the Org, without effecting any user mailboxes that are hosted on Exchange 2016?

Set-OrganizationConfig -DefaultAuthenticationPolicy "Block Legacy Auth"

Can we then slowly start migrating users over to Exchange 2019 while blocking legacy auth for only those mailboxes migrated over to Exchange 2019?

 

Should we wait until @The_Exchange_Team  fixes the default org config before moving forward?

@Rob Whaley (EXCHANGE) - I believe the answer to this is yes, do you concur? 

@Exchange_Admin  and @Greg Taylor - EXCHANGE That is correct, Exchange 2019 Authentication Policies should only apply to mailboxes that are homed on an Exchange 2019 server.

Visitor

@Greg Taylor - EXCHANGE  : With the release of CU9 KB5000631 is marked to be fixed. Does this mean the Events mentioned in the KB are no more triggered or the issue with being unable to set HMA Policies on the Org level is fixed as well?

 

Thanks as always!

I just checked with engineering and the answer is that yes, CU9 fixes both problems. The policies should now work and no event errors should be generated. 

Regular Visitor

That was much quicker than expected! Thanks Greg for validating, time to get this in place then :)

That was an easy one. Some comments here are much harder to respond to.... ;) 

Credit actually though goes to the people I asked... I'm just the messenger. 

Senior Member

@Greg Taylor - EXCHANGE It doesn't solve credential prompt loop when proxying connections on a DAG using HMA.

New Contributor

 

With a fully on-premises Exchange deployment, with no connection to Azure AAD, is there anything other than a legacy authentication protocol that can be used? Are there any plans from Microsoft to disable Basic Auth on Exchange OnPrem deployment?

New Contributor

@Greg Taylor - EXCHANGE : As mentioned by bbzome the issue with the flashing prompts seems still to be present even on CU9. Not sure if Engineering is aware therefor bringing this up again. Thanks!

%3CLINGO-SUB%20id%3D%22lingo-sub-715482%22%20slang%3D%22en-US%22%3ERe%3A%20Disabling%20Legacy%20Authentication%20in%20Exchange%20Server%202019%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-715482%22%20slang%3D%22en-US%22%3E%3CP%3EWe%E2%80%98d%20love%20to%20see%20this%20showing%20up%20for%20all%20Exchange%20releases%20that%20support%20Hybrid%20Modern%20Auth%20today%20-%20as%20companies%20may%20have%20reasons%20not%20to%20migrate%20to%202019%20yet%20due%20to%20their%20Cloud%20strategy%3C%2FP%3E%3CP%3EAny%20chance%20we%20could%20see%20this%20showing%20up%20in%20the%202016%20space%20as%20well%3F%20Thanks%20guys!%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-715657%22%20slang%3D%22en-US%22%3ERe%3A%20Disabling%20Legacy%20Authentication%20in%20Exchange%20Server%202019%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-715657%22%20slang%3D%22en-US%22%3EWhen%20will%20we%20see%20Modern%20Authentication%20on%20Exchange%20Server%202019%20without%20cloud%20(AAD)%20prerequisites%3F%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-725199%22%20slang%3D%22en-US%22%3ERe%3A%20Disabling%20Legacy%20Authentication%20in%20Exchange%20Server%202019%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-725199%22%20slang%3D%22en-US%22%3E%3CP%3EI%20am%20curious%20why%20kerberos%20is%20listed%20as%20a%20legacy%20authentication%20mechanism%2C%20especially%20why%20it%20is%20deemed%20unsafe.%20Are%20there%20security%20considerations%20concerning%20kerberos%3F%20Has%20the%20protocol%20been%20hacked%20or%20are%20there%20client%20and%2For%20server%20specific%20vulnerabilities%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ESince%20kerberos%20is%20used%20almost%20exclusively%20in%20an%20AD%20domain%20any%20vulnerabilities%20would%20be%20of%20great%20importance%20and%20interest%20to%20anybody%20using%20Windows%20in%20a%20work%20environment.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ESincerly%3C%2FP%3E%3CP%3EMarkus%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-726457%22%20slang%3D%22en-US%22%3ERe%3A%20Disabling%20Legacy%20Authentication%20in%20Exchange%20Server%202019%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-726457%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F356159%22%20target%3D%22_blank%22%3E%40Martin_Aigner%3C%2FA%3E%26nbsp%3B%20-%202019%20only%20for%20this%20feature.%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F367717%22%20target%3D%22_blank%22%3E%40MarkusTUD%3C%2FA%3E%26nbsp%3B-%20Kerberos%20will%20still%20be%20used%20between%20servers%2C%20but%20for%20clients%20it's%20much%20harder%20to%20enforce%20things%20like%20MFA%20and%20it%20can't%20be%20used%20from%20outside%20the%20network%20firewall%2Fedge.%20So%20we'd%20like%20to%20get%20clients%20off%20it%20and%20onto%20something%20better.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-715765%22%20slang%3D%22en-US%22%3ERe%3A%20Disabling%20Legacy%20Authentication%20in%20Exchange%20Server%202019%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-715765%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F63022%22%20target%3D%22_blank%22%3E%40Han%20Valk%3C%2FA%3E%3A%20The%20answer%20is%20in%20the%20Blog%20Article%20about%20the%20release%20of%20CU2%20%3B)%3C%2Fimg%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-712048%22%20slang%3D%22en-US%22%3EDisabling%20Legacy%20Authentication%20in%20Exchange%20Server%202019%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-712048%22%20slang%3D%22en-US%22%3E%3CP%3EWe%20are%20happy%20to%20announce%20our%20work%20to%20allow%20you%20to%20disable%20legacy%20authentication%20is%20available%20to%20you%20with%20the%20second%20cumulative%20update%20(CU2)%20for%20Exchange%202019.%20This%20provides%20an%20important%20step%20down%20the%20path%20of%20removing%20legacy%20authentication%20mechanisms%20from%20Exchange%20Hybrid%20deployments.%3C%2FP%3E%0A%3CP%3EThis%20feature%20is%20very%20similar%20to%20the%20functionality%20offered%20in%20Office%20365%20for%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-gb%2Fexchange%2Fclients-and-mobile-in-exchange-online%2Fdisable-basic-authentication-in-exchange-online%3FredirectSourcePath%3D%25252fen-us%25252farticle%25252fdisable-basic-authentication-in-exchange-online-bba2059a-7242-41d0-bb3f-baaf7ec1abd7%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3EDisabling%20Basic%20authentication.%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%3CFONT%20size%3D%225%22%3EWhy%20is%20this%20feature%20important%3F%3C%2FFONT%3E%3C%2FP%3E%0A%3CP%3EAs%20you%20probably%20know%2C%20legacy%20authentication%20methods%20are%20less%20secure%2C%20are%20vulnerable%20to%20interception%20and%20are%20susceptible%20to%20brute-force%20and%20password%20spray%20attacks.%20If%20your%20organization%20has%20no%20legacy%20email%20clients%20or%20doesn%E2%80%99t%20want%20to%20allow%20legacy%20email%20clients%2C%20you%20can%20use%20these%20new%20Authentication%20Policies%20in%20your%20Exchange%20Hybrid%20environment%20to%26nbsp%3Bdisable%20legacy%20authentication%20requests.%20This%20ensures%20only%20those%20clients%20that%20support%20%3CA%20href%3D%22https%3A%2F%2Fblogs.technet.microsoft.com%2Fexchange%2F2017%2F12%2F06%2Fannouncing-hybrid-modern-authentication-for-exchange-on-premises%2F%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3EHybrid%20Modern%20Authentication%3C%2FA%3E%20can%20connect%20to%20Exchange%20Server.%3C%2FP%3E%0A%3CP%3E%3CFONT%20size%3D%225%22%3EWhat%20are%20%E2%80%98legacy%E2%80%99%20authentication%20methods%3F%3C%2FFONT%3E%3C%2FP%3E%0A%3CP%3EExchange%20Server%20has%20been%20around%20for%2023%20years%2C%20so%20we%E2%80%99ve%20seen%20a%20lot%20of%20change%20over%20that%20time.%20We%E2%80%99ve%20had%20to%20support%20multiple%20authentication%20methods%20over%20this%20time%2C%20to%20keep%20in%20sync%20with%20clients%20and%20to%20allow%20simple%20migration.%20The%20following%20legacy%20authentication%20methods%20have%20historically%20been%20used%20to%20access%20Exchange%20servers%2C%20and%20it%E2%80%99s%20the%20removal%20of%20these%20were%20are%20interested%20in%20for%20the%20purposes%20of%20this%20feature%20and%20post.%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3EBasic%20authentication%3C%2FLI%3E%0A%3CLI%3EDigest%20authentication%3C%2FLI%3E%0A%3CLI%3EWindows%20authentication%20(NTLM%20and%20Kerberos)%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3E%3CFONT%20size%3D%225%22%3ESo%20what%20do%20you%20need%20to%20do%20to%20configure%20this%20new%20feature%3F%3C%2FFONT%3E%3C%2FP%3E%0A%3CP%3EPre-requisites%3C%2FP%3E%0A%3COL%3E%0A%3CLI%3EVerify%20that%20Hybrid%20Modern%20Authentication%20is%20enabled%20and%20successfully%20working%20in%20your%20Exchange%20Hybrid%20environment.%3C%2FLI%3E%0A%3CLI%3EVerify%20that%20all%20of%20your%20email%20clients%20and%20apps%20support%20Modern%20Authentication.%20Clients%20that%20currently%20support%20Hybrid%20Modern%20Auth%20are%20listed%20below.%20It%E2%80%99s%20also%20really%20important%20to%20keep%20your%20clients%20up%20to%20date%20%E2%80%93%20no%20only%20does%20that%20ensure%20they%20get%20fixes%20for%20any%20issues%20we%20find%2C%20but%20it%20means%20they%20get%20the%20latest%20features%20and%20capabilities%20too.%3C%2FLI%3E%0A%3C%2FOL%3E%0A%3CUL%3E%0A%3CLI%3EOutlook%202013%20or%20later%20(Outlook%202013%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Foffice365%2Fadmin%2Fsecurity-and-compliance%2Fenable-modern-authentication%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Erequires%20a%20registry%20key%20change%3C%2FA%3E)%3C%2FLI%3E%0A%3CLI%3EOutlook%202016%20for%20Mac%20or%20later%3C%2FLI%3E%0A%3CLI%3EOutlook%20for%20iOS%20and%20Android%3C%2FLI%3E%0A%3CLI%3EMail%20for%20iOS%2011.3.1%20or%20later%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3E%3CFONT%20size%3D%224%22%3EAuthentication%20Policies%3C%2FFONT%3E%3C%2FP%3E%0A%3CP%3EYou%20block%20legacy%20authentication%20in%20Exchange%20hybrid%20environments%20by%20creating%20%3CEM%3Eauthentication%20policies%3C%2FEM%3E.%20Authentication%20policies%20define%20the%20client%20protocols%20where%20legacy%20authentication%20is%20blocked%20(all%20protocols%20or%20specific%20protocols%2C%20although%20we%20typically%20recommend%20blocking%20legacy%20authentication%20for%20all%20protocols).%3C%2FP%3E%0A%3CP%3EAfter%20you%20create%20authentication%20policies%2C%20you%20assign%20them%20to%20users.%20Assigning%20a%20policy%20to%20users%20blocks%20their%20legacy%20authentication%20requests%20for%20the%20specified%20protocols.%20Note%20that%20for%20the%20policy%20to%20take%20effect%2C%20mailboxes%20must%20be%20on%20an%20Exchange%202019%20CU2%20server%20and%20connection%20to%20the%20mailbox%20cannot%20come%20through%20an%20older%20version%20of%20Exchange.%3C%2FP%3E%0A%3CP%3EYou%20manage%20all%20aspects%20of%20authentication%20policies%20in%20the%20Exchange%20Management%20Shell.%3C%2FP%3E%0A%3CP%3E%3CFONT%20size%3D%224%22%3ESupported%20Protocols%20and%20Services%3C%2FFONT%3E%3C%2FP%3E%0A%3CP%3EThe%20protocols%20and%20services%20in%20Exchange%20that%20you%20can%20block%20legacy%20authentication%20for%20are%20described%20in%20the%20following%20table.%3C%2FP%3E%0A%3CTABLE%20width%3D%22100%25%22%3E%0A%3CTBODY%3E%0A%3CTR%3E%0A%3CTD%3E%3CP%3E%3CSTRONG%3EProtocol%20or%20service%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%3E%3CP%3E%3CSTRONG%3EDescription%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%3E%3CP%3E%3CSTRONG%3EParameter%20name%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E%3CP%3EExchange%20Active%20Sync%20(EAS)%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%3E%3CP%3EUsed%20by%20some%20email%20clients%20on%20mobile%20devices.%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%3E%3CP%3E%3CEM%3EBlockLegacyAuthActiveSync%3C%2FEM%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E%3CP%3EAutodiscover%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%3E%3CP%3EUsed%20by%20Outlook%20and%20EAS%20clients%20to%20find%20and%20connect%20to%20mailboxes%20in%20Exchange%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%3E%3CP%3E%3CEM%3EBlockLegacyAuthAutodiscover%3C%2FEM%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E%3CP%3EIMAP%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%3E%3CP%3EUsed%20by%20IMAP%20email%20clients.%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%3E%3CP%3E%3CEM%3EBlockLegacyAuthImap%3C%2FEM%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E%3CP%3EMAPI%20over%20HTTP%20(MAPI%2FHTTP)%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%3E%3CP%3EUsed%20by%20Outlook%202013%20and%20later.%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%3E%3CP%3E%3CEM%3EBlockLegacyAuthMapi%3C%2FEM%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E%3CP%3EOffline%20Address%20Book%20(OAB)%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%3E%3CP%3EA%20copy%20of%20address%20list%20collections%20that%20are%20downloaded%20and%20used%20by%20Outlook.%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%3E%3CP%3E%3CEM%3EBlockLegacyAuthOfflineAddressBook%3C%2FEM%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E%3CP%3EPOP3%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%3E%3CP%3EUsed%20by%20POP%20email%20clients.%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%3E%3CP%3E%3CEM%3EBlockLegacyAuthPop%3C%2FEM%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E%3CP%3EOutlook%20Anywhere%20(RPC%20over%20HTTP)%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%3E%3CP%3EUsed%20by%20Outlook%202016%20and%20earlier.%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%3E%3CP%3E%3CEM%3EBlockLegacyAuthRpc%3C%2FEM%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E%3CP%3EExchange%20Web%20Services%20(EWS)%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%3E%3CP%3EA%20programming%20interface%20that%E2%80%99s%20used%20by%20Outlook%2C%20Outlook%20for%20Mac%2C%20and%20third-party%20apps.%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%3E%3CP%3E%3CEM%3EBlockLegacyAuthWebServices%3C%2FEM%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3C%2FTBODY%3E%0A%3C%2FTABLE%3E%0A%3CP%3ETypically%2C%20when%20you%20block%20legacy%20authentication%20for%20a%20user%2C%20we%20recommend%20that%20you%20block%20legacy%20authentication%20for%20all%20protocols.%20However%2C%20you%20can%20use%20the%20%3CEM%3EBlockLegacyAuth*%3C%2FEM%3E%20parameters%20(switches)%20on%20the%20%3CSTRONG%3ENew-AuthenticationPolicy%3C%2FSTRONG%3E%20and%20%3CSTRONG%3ESet-AuthenticationPolicy%3C%2FSTRONG%3E%20cmdlets%20to%20selectively%20allow%20or%20block%20legacy%20authentication%20for%20specific%20protocols.%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3E%3CFONT%20size%3D%223%22%3EStep%201%3A%20Create%20the%20Authentication%20Policy%3C%2FFONT%3E%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3ETo%20create%20a%20policy%20that%20blocks%20legacy%20authentication%20for%20the%20specified%20client%20protocol%2C%20use%20the%20%3CSTRONG%3ENew-AuthenticationPolicy%3C%2FSTRONG%3E%20cmdlet.%3C%2FP%3E%0A%3CP%3EThis%20example%20creates%20an%20authentication%20policy%20named%20%E2%80%9CBlock%20Legacy%20Auth%E2%80%9D%20to%20block%20legacy%20authentication%20for%20all%20client%20protocols%20in%20Exchange%202019%20(the%20recommended%20configuration).%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%3ENew-AuthenticationPolicy%20-Name%20%22Block%20Legacy%20Auth%22%20-BlockLegacyAuthActiveSync%20-BlockLegacyAuthAutodiscover%20-BlockLegacyAuthImap%20-BlockLegacyAuthMapi%20-BlockLegacyAuthOfflineAddressBook%20-BlockLegacyAuthPop%20-BlockLegacyAuthRpc%20-BlockLegacyAuthWebServices%3C%2FPRE%3E%0A%3CH1%20id%3D%22toc-hId-1985283283%22%20id%3D%22toc-hId-1985283283%22%20id%3D%22toc-hId-1985283283%22%20id%3D%22toc-hId-1985283283%22%20id%3D%22toc-hId-1985283283%22%20id%3D%22toc-hId-1985283283%22%20id%3D%22toc-hId-1985283283%22%20id%3D%22toc-hId-1985283283%22%20id%3D%22toc-hId-1985283283%22%20id%3D%22toc-hId-1985283283%22%20id%3D%22toc-hId-1985283283%22%20id%3D%22toc-hId-1985283283%22%20id%3D%22toc-hId-1985283283%22%20id%3D%22toc-hId-1985283283%22%20id%3D%22toc-hId-1985283283%22%20id%3D%22toc-hId-1985283283%22%20id%3D%22toc-hId-1985283283%22%20id%3D%22toc-hId-1985283283%22%20id%3D%22toc-hId-1985283283%22%20id%3D%22toc-hId-1985283283%22%20id%3D%22toc-hId-1985283283%22%20id%3D%22toc-hId-1985283283%22%20id%3D%22toc-hId-1985283283%22%20id%3D%22toc-hId-1985283283%22%20id%3D%22toc-hId-1985283283%22%20id%3D%22toc-hId-1985283283%22%20id%3D%22toc-hId-1985283283%22%20id%3D%22toc-hId-1985283283%22%20id%3D%22toc-hId-1985283283%22%20id%3D%22toc-hId-1985283283%22%20id%3D%22toc-hId-1985283283%22%20id%3D%22toc-hId-1985283283%22%20id%3D%22toc-hId-1985283283%22%20id%3D%22toc-hId-1985283283%22%20id%3D%22toc-hId-1985283283%22%20id%3D%22toc-hId-1985283283%22%20id%3D%22toc-hId-1985283283%22%20id%3D%22toc-hId-1985283283%22%20id%3D%22toc-hId-1985283283%22%20id%3D%22toc-hId-1985283283%22%20id%3D%22toc-hId-1985283283%22%3E%3CSTRONG%3E%3CFONT%20size%3D%223%22%3EStep%202%3A%20Assign%20the%20authentication%20policy%20to%20users%3C%2FFONT%3E%3C%2FSTRONG%3E%3C%2FH1%3E%0A%3CP%3EThe%20methods%20that%20you%20can%20use%20to%20assign%20authentication%20policies%20to%20users%20are%3A%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3EIndividual%20user%20accounts%3C%2FSTRONG%3E%3A%3C%2FP%3E%0A%3CP%3EThis%20example%20assigns%20the%20policy%20named%20Block%20Legacy%20Auth%20to%20the%20user%20account%20laura%40contoso.com.%3C%2FP%3E%0A%3CPRE%3ESet-User%20-Identity%20laura%40contoso.com%20-AuthenticationPolicy%20%22Block%20Legacy%20Auth%22%3C%2FPRE%3E%0A%3CP%3E%3CSTRONG%3EFilter%20user%20accounts%20by%20attributes%3C%2FSTRONG%3E%3A%20This%20method%20requires%20that%20the%20user%20accounts%20all%20share%20a%20unique%20filterable%20attribute%20(for%20example%2C%20Title%20or%20Department)%20that%20you%20can%20use%20to%20identify%20the%20users.%3C%2FP%3E%0A%3CP%3EThis%20example%20assigns%20the%20policy%20named%20Block%20Legacy%20Auth%20to%20all%20user%20accounts%20whose%20%3CSTRONG%3ETitle%3C%2FSTRONG%3E%20attribute%20contains%20the%20value%20%E2%80%9CSales%20Associate%E2%80%9D.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%3E%24SalesUsers%20%3D%20Get-User%20-ResultSize%20unlimited%20-Filter%20%7B(RecipientType%20-eq%20'UserMailbox')%20-and%20(Title%20-like%20'*Sales%20Associate*')%7D%0A%24Sales%20%3D%20%24SalesUsers.SamAccountName%0A%24Sales%20%7C%20foreach%20%7BSet-User%20-Identity%20%24_%20-AuthenticationPolicy%20%22Block%20Legacy%20Auth%22%7D%3C%2FPRE%3E%0A%3CP%3E%3CSTRONG%3EUse%20a%20list%20of%20specific%20user%20accounts%3C%2FSTRONG%3E%3A%20This%20method%20requires%20a%20text%20file%20to%20identify%20the%20user%20accounts.%20Values%20that%20don%E2%80%99t%20contain%20spaces%20(for%20example%2C%20the%20user%20principal%20name%20or%20UPN)%20work%20best.%20The%20text%20file%20must%20contain%20one%20user%20account%20on%20each%20line%20like%20this%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%3Eakol%40contoso.com%0Atjohnston%40contoso.com%0Akakers%40contoso.com%3C%2FPRE%3E%0A%3CP%3EThe%20syntax%20uses%20two%20commands%20(one%20to%20identify%20the%20user%20accounts%2C%20and%20the%20other%20to%20apply%20the%20policy%20to%20those%20users).%3C%2FP%3E%0A%3CP%3EThis%20example%20assigns%20the%20policy%20named%20Block%20Legacy%20Auth%20to%20the%20user%20accounts%20specified%20in%20the%20%3CSPAN%3EC%3A%5CMy%20Documents%5CBlockLegacyAuth.txt%3C%2FSPAN%3E%20file%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%3E%24BLA%20%3D%20Get-Content%20%22C%3A%5CMy%20Documents%5CBlockLegacyAuth.txt%22%0A%24BLA%20%7C%20foreach%20%7BSet-User%20-Identity%20%24_%20-AuthenticationPolicy%20%22Block%20Legacy%20Auth%22%7D%3C%2FPRE%3E%0A%3CP%3E%3CSTRONG%3EConfigure%20the%20default%20authentication%20policy%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3EThe%20default%20authentication%20policy%20is%20assigned%20to%20all%20users%20who%20don%E2%80%99t%20already%20have%20a%20specific%20policy%20assigned%20to%20them%20(a%20directly%20assigned%20policy%20takes%20precedence).%3C%2FP%3E%0A%3CP%3EYou%20can%20configure%20the%20default%20authentication%20policy%20for%20the%20organization%2C%20using%20the%3C%2FP%3E%0A%3CP%3E%3CSPAN%3ESet-OrganizationConfig%20cmdlet.%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3EThis%20example%20below%20configures%20the%20authentication%20policy%20named%20%E2%80%9CBlock%20Legacy%20Auth%E2%80%9D%20as%20the%20default%20policy.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%3ESet-OrganizationConfig%20-DefaultAuthenticationPolicy%20%22Block%20Legacy%20Auth%22%3C%2FPRE%3E%0A%3CP%3E%3CFONT%20size%3D%224%22%3EHow%20does%20this%20feature%20work%20in%20practice%3F%3C%2FFONT%3E%3C%2FP%3E%0A%3CP%3EThe%20diagrams%20below%20illustrate%20how%20this%20feature%20works%20once%20a%20policy%20has%20been%20created%20and%20assigned.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-center%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F119985iE8CF0EFAFF81B3CB%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22HMA%20Flow.png%22%20title%3D%22HMA%20Flow.png%22%20%2F%3E%3CSPAN%20class%3D%22lia-inline-image-caption%22%20onclick%3D%22event.preventDefault()%3B%22%3EHybrid%20Modern%20Auth%20Flow%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-center%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F119986i7521781B5E2420EA%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22Legacy%20Auth%20Flow.png%22%20title%3D%22Legacy%20Auth%20Flow.png%22%20%2F%3E%3CSPAN%20class%3D%22lia-inline-image-caption%22%20onclick%3D%22event.preventDefault()%3B%22%3ELegacy%20Auth%20Flow%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CH1%20id%3D%22toc-hId--566873678%22%20id%3D%22toc-hId--566873678%22%20id%3D%22toc-hId--566873678%22%20id%3D%22toc-hId--566873678%22%20id%3D%22toc-hId--566873678%22%20id%3D%22toc-hId--566873678%22%20id%3D%22toc-hId--566873678%22%20id%3D%22toc-hId--566873678%22%20id%3D%22toc-hId--566873678%22%20id%3D%22toc-hId--566873678%22%20id%3D%22toc-hId--566873678%22%20id%3D%22toc-hId--566873678%22%20id%3D%22toc-hId--566873678%22%20id%3D%22toc-hId--566873678%22%20id%3D%22toc-hId--566873678%22%20id%3D%22toc-hId--566873678%22%20id%3D%22toc-hId--566873678%22%20id%3D%22toc-hId--566873678%22%20id%3D%22toc-hId--566873678%22%20id%3D%22toc-hId--566873678%22%20id%3D%22toc-hId--566873678%22%20id%3D%22toc-hId--566873678%22%20id%3D%22toc-hId--566873678%22%20id%3D%22toc-hId--566873678%22%20id%3D%22toc-hId--566873678%22%20id%3D%22toc-hId--566873678%22%20id%3D%22toc-hId--566873678%22%20id%3D%22toc-hId--566873678%22%20id%3D%22toc-hId--566873678%22%20id%3D%22toc-hId--566873678%22%20id%3D%22toc-hId--566873678%22%20id%3D%22toc-hId--566873678%22%20id%3D%22toc-hId--566873678%22%20id%3D%22toc-hId--566873678%22%20id%3D%22toc-hId--566873678%22%20id%3D%22toc-hId--566873678%22%20id%3D%22toc-hId--566873678%22%20id%3D%22toc-hId--566873678%22%20id%3D%22toc-hId--566873678%22%20id%3D%22toc-hId--566873678%22%20id%3D%22toc-hId--566873678%22%3E%3CFONT%20size%3D%224%22%3EHow%20do%20I%20view%20authentication%20policies%3F%3C%2FFONT%3E%3C%2FH1%3E%0A%3CP%3ETo%20view%20a%20summary%20list%20of%20the%20names%20of%20all%20existing%20authentication%20policies%2C%20run%20the%20following%20command%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%3EGet-AuthenticationPolicy%20%7C%20Format-Table%20-Auto%20Name%3C%2FPRE%3E%0A%3CP%3ETo%20view%20detailed%20information%20about%20a%20specific%20authentication%20policy%2C%20use%20this%20syntax%3A%3C%2FP%3E%0A%3CPRE%3EGet-AuthenticationPolicy%20-Identity%20%22Block%20Legacy%20Auth%22%3C%2FPRE%3E%0A%3CP%3E%3CFONT%20size%3D%224%22%3E%3CSTRONG%3EHow%20do%20I%20remove%20authentication%20policies%3F%3C%2FSTRONG%3E%3C%2FFONT%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%3ETo%20remove%20the%20policy%20run%20the%20following%20command.%20Please%20note%20that%20it%20would%20take%20around%20one%20hour%20for%20policy%20to%20be%20removed%20after%20the%20command%20is%20executed.%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3ETo%20remove%20the%20policy%20for%20a%20particular%20user%20%2C%20say%20userA%2C%20use%20the%20following%20command.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%3ESet-User%20userA%20-AuthenticationPolicy%20%24null%3C%2FPRE%3E%0A%3CP%3ETo%20remove%20the%20policy%20for%20the%20Organization%20level%20%2C%20use%20the%20following%20command.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%3ESet-OrganizationConfig%20-DefaultAuthenticationPolicy%20%24null%3C%2FPRE%3E%0A%3CH1%20id%3D%22toc-hId-1175936657%22%20id%3D%22toc-hId-1175936657%22%20id%3D%22toc-hId-1175936657%22%20id%3D%22toc-hId-1175936657%22%20id%3D%22toc-hId-1175936657%22%20id%3D%22toc-hId-1175936657%22%20id%3D%22toc-hId-1175936657%22%20id%3D%22toc-hId-1175936657%22%20id%3D%22toc-hId-1175936657%22%20id%3D%22toc-hId-1175936657%22%20id%3D%22toc-hId-1175936657%22%20id%3D%22toc-hId-1175936657%22%20id%3D%22toc-hId-1175936657%22%20id%3D%22toc-hId-1175936657%22%20id%3D%22toc-hId-1175936657%22%20id%3D%22toc-hId-1175936657%22%20id%3D%22toc-hId-1175936657%22%20id%3D%22toc-hId-1175936657%22%20id%3D%22toc-hId-1175936657%22%20id%3D%22toc-hId-1175936657%22%20id%3D%22toc-hId-1175936657%22%20id%3D%22toc-hId-1175936657%22%20id%3D%22toc-hId-1175936657%22%20id%3D%22toc-hId-1175936657%22%20id%3D%22toc-hId-1175936657%22%20id%3D%22toc-hId-1175936657%22%20id%3D%22toc-hId-1175936657%22%20id%3D%22toc-hId-1175936657%22%20id%3D%22toc-hId-1175936657%22%20id%3D%22toc-hId-1175936657%22%20id%3D%22toc-hId-1175936657%22%20id%3D%22toc-hId-1175936657%22%20id%3D%22toc-hId-1175936657%22%20id%3D%22toc-hId-1175936657%22%20id%3D%22toc-hId-1175936657%22%20id%3D%22toc-hId-1175936657%22%20id%3D%22toc-hId-1175936657%22%20id%3D%22toc-hId-1175936657%22%20id%3D%22toc-hId-1175936657%22%20id%3D%22toc-hId-1175936657%22%20id%3D%22toc-hId-1175936657%22%3E%3CFONT%20size%3D%225%22%3ESummary%3C%2FFONT%3E%3C%2FH1%3E%0A%3CP%3EYou%20now%20have%20a%20way%20to%20block%20legacy%20authentication%20mechanisms%20for%20users%20in%20your%20Organisation%20so%20that%20they%20all%20can%20use%20Modern%20Authenticaion%20.%20We%20would%20love%20to%20hear%20your%20feedback.%20Please%20do%20leave%20us%20comments%20below.%3C%2FP%3E%0A%3CP%3EThank%20you%2C%3C%2FP%3E%0A%3CP%3EThe%20Exchange%20Team%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-TEASER%20id%3D%22lingo-teaser-712048%22%20slang%3D%22en-US%22%3E%3CP%3ELegacy%20authentication%20methods%20are%20less%20secure%2C%20are%20vulnerable%20to%20interception%20and%20are%20susceptible%20to%20brute-force%20and%20password%20spray%20attacks.%20Use%20Authentication%20Policies%20in%20your%20Exchange%20Hybrid%20environment%20to%26nbsp%3Bdisable%20legacy%20authentication%20requests%3C%2FP%3E%3C%2FLINGO-TEASER%3E%3CLINGO-LABS%20id%3D%22lingo-labs-712048%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EExchange%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-887867%22%20slang%3D%22en-US%22%3ERe%3A%20Disabling%20Legacy%20Authentication%20in%20Exchange%20Server%202019%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-887867%22%20slang%3D%22en-US%22%3E%3CP%3EI%20have%20a%20question%20-%20why%20can't%20we%20just%20remove%20all%20the%20other%20authentication%20protocols%20(Basic%2C%20NTLM%2C%20Windows%20Integrated%20etc.)%20and%20leave%20only%20oAuth%20from%2C%20say%20from%20MAPI%20virtual%20directory%20and%20only%20enforce%20HMA%20for%20Outlook%20connection%20%3F%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-890299%22%20slang%3D%22en-US%22%3ERe%3A%20Disabling%20Legacy%20Authentication%20in%20Exchange%20Server%202019%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-890299%22%20slang%3D%22en-US%22%3E%3CP%3EBecause%20setup%2C%20CU's%20and%20our%20cmdlets%20will%20keep%20adding%20them%20back%20-%20we%20need%20some%20of%20those%20for%20server%20to%20server%20auth.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-891201%22%20slang%3D%22en-US%22%3ERe%3A%20Disabling%20Legacy%20Authentication%20in%20Exchange%20Server%202019%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-891201%22%20slang%3D%22en-US%22%3E%3CP%3EDoes%20server%20to%20server%20communication%20use%20Basic%20and%20NTLM%20authentication%20as%20well%20%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-892589%22%20slang%3D%22en-US%22%3ERe%3A%20Disabling%20Legacy%20Authentication%20in%20Exchange%20Server%202019%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-892589%22%20slang%3D%22en-US%22%3E%3CP%3ENot%20generally%2C%20though%20MRS%20based%20mailbox%20moves%20use%20NTLM.%20Turning%20off%20Basic%20using%20the%20cmdlets%20if%20fine%20imho%20-%20but%20turning%20off%20IWA%20is%20not.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-893327%22%20slang%3D%22en-US%22%3ERe%3A%20Disabling%20Legacy%20Authentication%20in%20Exchange%20Server%202019%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-893327%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F149115%22%20target%3D%22_blank%22%3E%40Greg%20Taylor%20-%20EXCHANGE%3C%2FA%3E%26nbsp%3B%20-%20Thank%20you%20!%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-935399%22%20slang%3D%22en-US%22%3ERe%3A%20Disabling%20Legacy%20Authentication%20in%20Exchange%20Server%202019%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-935399%22%20slang%3D%22en-US%22%3E%3CP%3EThis%20is%20great%20news%2C%20going%20to%20look%20at%20implementing%20this.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EGreg%2C%20when%20you%20say%20Exchange%20continues%20to%20leverage%20NTLM%20in%20some%20places%2C%20if%20one%20was%20to%20implement%20NTLM%20blocking%20using%20GPO%20(%3CSTRONG%3ENetwork%20security%3A%20Restrict%20NTLM%3A%20NTLM%20authentication%20in%20this%20domain%3C%2FSTRONG%3E)%20this%20would%20break%20Exchange%20if%20we%20have%20multiple%20Exchange%20servers%3F%20The%20goal%20being%20to%20enforce%20usage%20of%20Kerberos%20instead.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-937150%22%20slang%3D%22en-US%22%3ERe%3A%20Disabling%20Legacy%20Authentication%20in%20Exchange%20Server%202019%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-937150%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F220326%22%20target%3D%22_blank%22%3E%40Mirza%20Dedic%3C%2FA%3E%26nbsp%3B-%20it%20wouldn't%20be%20supported%2C%20and%20some%20things%20might%20break%20(MRS%20based%20moves%20to%20O365%20use%20NTLM%2C%20just%20one%20example).%20You%20can't%20do%20Kerberos%20from%20outside%20the%20firewall%20either%2C%20so%20if%20you%20use%20Outlook%20Anywhere%2C%20you%20can't%20use%20Kerb%20for%20users%20outside%20the%20firewall.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1502725%22%20slang%3D%22en-US%22%3ERe%3A%20Disabling%20Legacy%20Authentication%20in%20Exchange%20Server%202019%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1502725%22%20slang%3D%22en-US%22%3E%3CP%3EHey%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F149115%22%20target%3D%22_blank%22%3E%40Greg%20Taylor%20-%20EXCHANGE%3C%2FA%3E%26nbsp%3B%2C%20great%20article.%26nbsp%3B%3C%2FP%3E%3CP%3EWhen%20we%20will%20see%20ModernAuth%20100%25%20on-premise%20without%20hybrid%20modern%20authentication%20requirement%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1503213%22%20slang%3D%22en-US%22%3ERe%3A%20Disabling%20Legacy%20Authentication%20in%20Exchange%20Server%202019%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1503213%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F158664%22%20target%3D%22_blank%22%3E%40Jonathan%20Santos%3C%2FA%3E%26nbsp%3B%20-%20never%2C%20we%20decided%20to%20shelve%20that%20plan%20and%20announced%20it%20here%20-%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fexchange-team-blog%2Freleased-june-2019-quarterly-exchange-updates%2Fba-p%2F698398%22%20target%3D%22_blank%22%3Ehttps%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fexchange-team-blog%2Freleased-june-2019-quarterly-exchange-updates%2Fba-p%2F698398%3C%2FA%3E%26nbsp%3B.%20Sorry.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1831780%22%20slang%3D%22en-US%22%3ERe%3A%20Disabling%20Legacy%20Authentication%20in%20Exchange%20Server%202019%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1831780%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F149115%22%20target%3D%22_blank%22%3E%40Greg%20Taylor%20-%20EXCHANGE%3C%2FA%3E%26nbsp%3BCan%20we%20use%20this%20feature%20by%20adding%20some%20Exchange%202019%20servers%20to%20our%20Exchange%202016%20environment%20and%20then%20route%20all%20incoming%20traffic%20like%20EWS%20from%20the%20internet%20to%20these%202019%20server%20to%20be%20able%20to%20use%20modern%20auth%20and%20and%20block%20legacy%20auth%20at%20the%20same%20time%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1840468%22%20slang%3D%22en-US%22%3ERe%3A%20Disabling%20Legacy%20Authentication%20in%20Exchange%20Server%202019%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1840468%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F54629%22%20target%3D%22_blank%22%3E%40%C2%AEwin%20.%3C%2FA%3E%26nbsp%3B%20Authentication%20Policies%20only%20apply%20to%20mailboxes%20homed%20on%202019%20as%20the%20blog%20says%3A%20%22%3CSPAN%3ENote%20that%20for%20the%20policy%20to%20take%20effect%2C%20mailboxes%20must%20be%20on%20an%20Exchange%202019%20CU2%20server%3C%2FSPAN%3E%22%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1965484%22%20slang%3D%22en-US%22%3ERe%3A%20Disabling%20Legacy%20Authentication%20in%20Exchange%20Server%202019%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1965484%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F149115%22%20target%3D%22_blank%22%3E%40Greg%20Taylor%20-%20EXCHANGE%3C%2FA%3E%26nbsp%3Bwhen%20I%20set%20the%20policy%20at%20the%20organization%20level%20things%20stop%20working.%20Once%20I%20execute%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CPRE%3ESet-OrganizationConfig%20-DefaultAuthenticationPolicy%20%22Block%20Legacy%20Auth%22%3C%2FPRE%3E%3CP%3Ewindows%2Fdialog%20boxes%20will%20start%20flashing%20on%20half%20of%20the%20outlook%20clients.%20It%20flashes%20fast%20and%20I%20can't%20tell%20if%20there%20is%20any%20content.%20Also%2C%20half%20the%20phones%20will%20stop%20working.%20When%20I%20set%20the%20authentication%20policy%20back%20to%20null%20everything%20starts%20working%20again%20but%20legacy%20auth%20is%20still%20enabled.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIf%20I%20set%20the%20authorization%20policy%20at%20the%20user%20level%20things%20work%20as%20you%20would%20expect.%20HMA%20seems%20to%20function%20just%20fine%20on%20the%20same%20outlook%20clients%20and%20phones%20that%20have%20an%20issue%20if%20the%20policy%20is%20set%20at%20the%20org%20level.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWe%20have%20a%202%20node%20DAG%20and%20we're%20using%20roundrobin%20DNS%20for%20load%20balancing.%20I'm%20not%20100%25%20but%20it%20seems%20to%20be%20that%20the%20clients%20have%20an%20issue%20if%20they're%20connecting%20to%20the%20node%20that%20doesn't%20house%20the%20database%20that%20their%20mailbox%20is%20on.%20I%20think%3F%20There%20isn't%20anything%20that%20needs%20to%20be%20done%20to%20proxy%20the%20modern%20auth%20requests%20between%20the%20servers%20is%20there%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWhen%20I%20enabled%20the%20policy%20at%20the%20org%20level%20I%20start%20seeing%20unhandled%20exceptions%20in%20the%20event%20logs%20that%20all%20seem%20to%20point%20to%20some%20kind%20of%20duplicate%20key%20but%20I%20can't%20figure%20out%20what%20that%20duplicate%20key%20is...%20any%20thoughts%3F%20Here%20are%20some%20examples%20from%20the%20event%20log%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CPRE%3ELog%20Name%3A%20Application%0ASource%3A%20MSExchange%20Front%20End%20HTTP%20Proxy%0AEvent%20ID%3A%201003%0ATask%20Category%3A%20Core%0ALevel%3A%20Error%0AKeywords%3A%20Classic%0AUser%3A%20N%2FA%0ADescription%3A%0A%5BOwa%5D%20An%20internal%20server%20error%20occurred.%20The%20unhandled%20exception%20was%3A%20Microsoft.Exchange.Collections.TimeoutCache.DuplicateKeyException%3A%20Cannot%20add%20a%20duplicate%20key.%20Use%20Insert%20instead%0Aat%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.CacheReader.AddEntry(String%20userKey%2C%20Int32%20userPolicy%2C%20ConfigWrapper%20config)%0Aat%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyRepo.GetUserPolicy(String%20userKey%2C%20Int32%20traceId%2C%20Int32%26amp%3B%20userPolicy%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0Aat%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyEvaluator.IsBasicAuthAllowed(String%20userKey%2C%20String%20protocolName%2C%20Int32%20traceId%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0Aat%20Microsoft.Exchange.HttpProxy.ProxyModule.IsLegacyAuthAllowed(HttpApplication%20httpApplication)%0Aat%20Microsoft.Exchange.HttpProxy.ProxyModule.OnPostAuthenticateInternal(HttpApplication%20httpApplication)%0Aat%20Microsoft.Exchange.Common.IL.ILUtil.DoTryFilterCatch(Action%20tryDelegate%2C%20Func%602%20filterDelegate%2C%20Action%601%20catchDelegate)%0AEvent%20Xml%3A%0A%26lt%3BEvent%20xmlns%3D%22http%3A%2F%2Fschemas.microsoft.com%2Fwin%2F2004%2F08%2Fevents%2Fevent%22%26gt%3B%0A%26lt%3BSystem%26gt%3B%0A%26lt%3BProvider%20Name%3D%22MSExchange%20Front%20End%20HTTP%20Proxy%22%20%2F%26gt%3B%0A%26lt%3BEventID%20Qualifiers%3D%2249152%22%26gt%3B1003%26lt%3B%2FEventID%26gt%3B%0A%26lt%3BLevel%26gt%3B2%26lt%3B%2FLevel%26gt%3B%0A%26lt%3BTask%26gt%3B1%26lt%3B%2FTask%26gt%3B%0A%26lt%3BKeywords%26gt%3B0x80000000000000%26lt%3B%2FKeywords%26gt%3B%0A%26lt%3BEventRecordID%26gt%3B861239%26lt%3B%2FEventRecordID%26gt%3B%0A%26lt%3BChannel%26gt%3BApplication%26lt%3B%2FChannel%26gt%3B%0A%26lt%3BSecurity%20%2F%26gt%3B%0A%26lt%3B%2FSystem%26gt%3B%0A%26lt%3BEventData%26gt%3B%0A%26lt%3BData%26gt%3BOwa%26lt%3B%2FData%26gt%3B%0A%26lt%3BData%26gt%3BMicrosoft.Exchange.Collections.TimeoutCache.DuplicateKeyException%3A%20Cannot%20add%20a%20duplicate%20key.%20Use%20Insert%20instead%0Aat%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.CacheReader.AddEntry(String%20userKey%2C%20Int32%20userPolicy%2C%20ConfigWrapper%20config)%0Aat%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyRepo.GetUserPolicy(String%20userKey%2C%20Int32%20traceId%2C%20Int32%26amp%3Bamp%3B%20userPolicy%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0Aat%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyEvaluator.IsBasicAuthAllowed(String%20userKey%2C%20String%20protocolName%2C%20Int32%20traceId%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0Aat%20Microsoft.Exchange.HttpProxy.ProxyModule.IsLegacyAuthAllowed(HttpApplication%20httpApplication)%0Aat%20Microsoft.Exchange.HttpProxy.ProxyModule.OnPostAuthenticateInternal(HttpApplication%20httpApplication)%0Aat%20Microsoft.Exchange.Common.IL.ILUtil.DoTryFilterCatch(Action%20tryDelegate%2C%20Func%602%20filterDelegate%2C%20Action%601%20catchDelegate)%26lt%3B%2FData%26gt%3B%0A%26lt%3B%2FEventData%26gt%3B%0A%26lt%3B%2FEvent%26gt%3B%3C%2FPRE%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CDIV%3E%3CDIV%3E%3CPRE%3ELog%20Name%3A%20%20%20%20%20%20Application%0ASource%3A%20%20%20%20%20%20%20%20MSExchange%20Autodiscover%0AEvent%20ID%3A%20%20%20%20%20%201%0ATask%20Category%3A%20Web%0ALevel%3A%20%20%20%20%20%20%20%20%20Error%0AKeywords%3A%20%20%20%20%20%20Classic%0AUser%3A%20%20%20%20%20%20%20%20%20%20N%2FA%0ADescription%3A%0AUnhandled%20Exception%20%22Cannot%20add%20a%20duplicate%20key.%20%20Use%20Insert%20instead%22%0AStack%20trace%3A%20%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.CacheReader.AddEntry(String%20userKey%2C%20Int32%20userPolicy%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyRepo.GetUserPolicy(String%20userKey%2C%20Int32%20traceId%2C%20Int32%26amp%3B%20userPolicy%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyEvaluator.IsBasicAuthAllowed(String%20userKey%2C%20String%20protocolName%2C%20Int32%20traceId%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.BackendRehydrationModule.IsLegacyAuthAllowed(HttpContext%20httpContext)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.BackendRehydrationModule.OnAuthenticateRequest(Object%20source%2C%20EventArgs%20args)%0A%20%20%20at%20System.Web.HttpApplication.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()%0A%20%20%20at%20System.Web.HttpApplication.ExecuteStepImpl(IExecutionStep%20step)%0A%20%20%20at%20System.Web.HttpApplication.ExecuteStep(IExecutionStep%20step%2C%20Boolean%26amp%3B%20completedSynchronously)%0AEvent%20Xml%3A%0A%26lt%3BEvent%20xmlns%3D%22http%3A%2F%2Fschemas.microsoft.com%2Fwin%2F2004%2F08%2Fevents%2Fevent%22%26gt%3B%0A%20%20%26lt%3BSystem%26gt%3B%0A%20%20%20%20%26lt%3BProvider%20Name%3D%22MSExchange%20Autodiscover%22%20%2F%26gt%3B%0A%20%20%20%20%26lt%3BEventID%20Qualifiers%3D%2249152%22%26gt%3B1%26lt%3B%2FEventID%26gt%3B%0A%20%20%20%20%26lt%3BLevel%26gt%3B2%26lt%3B%2FLevel%26gt%3B%0A%20%20%20%20%26lt%3BTask%26gt%3B2%26lt%3B%2FTask%26gt%3B%0A%20%20%20%20%26lt%3BKeywords%26gt%3B0x80000000000000%26lt%3B%2FKeywords%26gt%3B%0A%20%20%20%20%26lt%3BEventRecordID%26gt%3B861169%26lt%3B%2FEventRecordID%26gt%3B%0A%20%20%20%20%26lt%3BChannel%26gt%3BApplication%26lt%3B%2FChannel%26gt%3B%0A%20%20%20%20%26lt%3BSecurity%20%2F%26gt%3B%0A%20%20%26lt%3B%2FSystem%26gt%3B%0A%20%20%26lt%3BEventData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3BCannot%20add%20a%20duplicate%20key.%20%20Use%20Insert%20instead%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3B%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.CacheReader.AddEntry(String%20userKey%2C%20Int32%20userPolicy%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyRepo.GetUserPolicy(String%20userKey%2C%20Int32%20traceId%2C%20Int32%26amp%3Bamp%3B%20userPolicy%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyEvaluator.IsBasicAuthAllowed(String%20userKey%2C%20String%20protocolName%2C%20Int32%20traceId%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.BackendRehydrationModule.IsLegacyAuthAllowed(HttpContext%20httpContext)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.BackendRehydrationModule.OnAuthenticateRequest(Object%20source%2C%20EventArgs%20args)%0A%20%20%20at%20System.Web.HttpApplication.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()%0A%20%20%20at%20System.Web.HttpApplication.ExecuteStepImpl(IExecutionStep%20step)%0A%20%20%20at%20System.Web.HttpApplication.ExecuteStep(IExecutionStep%20step%2C%20Boolean%26amp%3Bamp%3B%20completedSynchronously)%26lt%3B%2FData%26gt%3B%0A%20%20%26lt%3B%2FEventData%26gt%3B%0A%26lt%3B%2FEvent%26gt%3B%3C%2FPRE%3E%3CPRE%3ELog%20Name%3A%20%20%20%20%20%20Application%0ASource%3A%20%20%20%20%20%20%20%20MSExchange%20Front%20End%20HTTP%20Proxy%0AEvent%20ID%3A%20%20%20%20%20%201003%0ATask%20Category%3A%20Core%0ALevel%3A%20%20%20%20%20%20%20%20%20Error%0AKeywords%3A%20%20%20%20%20%20Classic%0AUser%3A%20%20%20%20%20%20%20%20%20%20N%2FA%0ADescription%3A%0A%5BEws%5D%20An%20internal%20server%20error%20occurred.%20The%20unhandled%20exception%20was%3A%20Microsoft.Exchange.Collections.TimeoutCache.DuplicateKeyException%3A%20Cannot%20add%20a%20duplicate%20key.%20%20Use%20Insert%20instead%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.CacheReader.AddEntry(String%20userKey%2C%20Int32%20userPolicy%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyRepo.GetUserPolicy(String%20userKey%2C%20Int32%20traceId%2C%20Int32%26amp%3B%20userPolicy%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyEvaluator.IsBasicAuthAllowed(String%20userKey%2C%20String%20protocolName%2C%20Int32%20traceId%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.HttpProxy.ProxyModule.IsLegacyAuthAllowed(HttpApplication%20httpApplication)%0A%20%20%20at%20Microsoft.Exchange.HttpProxy.ProxyModule.OnPostAuthenticateInternal(HttpApplication%20httpApplication)%0A%20%20%20at%20Microsoft.Exchange.Common.IL.ILUtil.DoTryFilterCatch(Action%20tryDelegate%2C%20Func%602%20filterDelegate%2C%20Action%601%20catchDelegate)%0AEvent%20Xml%3A%0A%26lt%3BEvent%20xmlns%3D%22http%3A%2F%2Fschemas.microsoft.com%2Fwin%2F2004%2F08%2Fevents%2Fevent%22%26gt%3B%0A%20%20%26lt%3BSystem%26gt%3B%0A%20%20%20%20%26lt%3BProvider%20Name%3D%22MSExchange%20Front%20End%20HTTP%20Proxy%22%20%2F%26gt%3B%0A%20%20%20%20%26lt%3BEventID%20Qualifiers%3D%2249152%22%26gt%3B1003%26lt%3B%2FEventID%26gt%3B%0A%20%20%20%20%26lt%3BLevel%26gt%3B2%26lt%3B%2FLevel%26gt%3B%0A%20%20%20%20%26lt%3BTask%26gt%3B1%26lt%3B%2FTask%26gt%3B%0A%20%20%20%20%26lt%3BKeywords%26gt%3B0x80000000000000%26lt%3B%2FKeywords%26gt%3B%0A%20%20%20%20%26lt%3BEventRecordID%26gt%3B861163%26lt%3B%2FEventRecordID%26gt%3B%0A%20%20%20%20%26lt%3BChannel%26gt%3BApplication%26lt%3B%2FChannel%26gt%3B%0A%20%20%20%20%26lt%3BSecurity%20%2F%26gt%3B%0A%20%20%26lt%3B%2FSystem%26gt%3B%0A%20%20%26lt%3BEventData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3BEws%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3BMicrosoft.Exchange.Collections.TimeoutCache.DuplicateKeyException%3A%20Cannot%20add%20a%20duplicate%20key.%20%20Use%20Insert%20instead%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.CacheReader.AddEntry(String%20userKey%2C%20Int32%20userPolicy%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyRepo.GetUserPolicy(String%20userKey%2C%20Int32%20traceId%2C%20Int32%26amp%3Bamp%3B%20userPolicy%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyEvaluator.IsBasicAuthAllowed(String%20userKey%2C%20String%20protocolName%2C%20Int32%20traceId%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.HttpProxy.ProxyModule.IsLegacyAuthAllowed(HttpApplication%20httpApplication)%0A%20%20%20at%20Microsoft.Exchange.HttpProxy.ProxyModule.OnPostAuthenticateInternal(HttpApplication%20httpApplication)%0A%20%20%20at%20Microsoft.Exchange.Common.IL.ILUtil.DoTryFilterCatch(Action%20tryDelegate%2C%20Func%602%20filterDelegate%2C%20Action%601%20catchDelegate)%26lt%3B%2FData%26gt%3B%0A%20%20%26lt%3B%2FEventData%26gt%3B%0A%26lt%3B%2FEvent%26gt%3B%3C%2FPRE%3E%3CPRE%3ELog%20Name%3A%20%20%20%20%20%20Application%0ASource%3A%20%20%20%20%20%20%20%20ASP.NET%204.0.30319.0%0AEvent%20ID%3A%20%20%20%20%20%201309%0ATask%20Category%3A%20Web%20Event%0ALevel%3A%20%20%20%20%20%20%20%20%20Warning%0AKeywords%3A%20%20%20%20%20%20Classic%0AUser%3A%20%20%20%20%20%20%20%20%20%20N%2FA%0ADescription%3A%0AEvent%20code%3A%203005%20%0AEvent%20message%3A%20An%20unhandled%20exception%20has%20occurred.%20%0AEvent%20ID%3A%20f227e48f4d474111873957cee43f41ff%20%0AEvent%20sequence%3A%202%20%0AEvent%20occurrence%3A%201%20%0AEvent%20detail%20code%3A%200%20%0A%20%0AApplication%20information%3A%20%0A%20%20%20%20Application%20domain%3A%20%2FLM%2FW3SVC%2F2%2FROOT%2FEWS-2-132518667113847979%20%0A%20%20%20%20Trust%20level%3A%20Full%20%0A%20%20%20%20Application%20Virtual%20Path%3A%20%2FEWS%20%0A%20%20%20%20Application%20Path%3A%20C%3A%5CProgram%20Files%5CMicrosoft%5CExchange%20Server%5CV15%5CClientAccess%5Cexchweb%5CEWS%5C%20%0A%20%0AProcess%20information%3A%20%0A%20%20%20%20Process%20ID%3A%2012016%20%0A%20%20%20%20Process%20name%3A%20w3wp.exe%20%0A%20%20%20%20Account%20name%3A%20NT%20AUTHORITY%5CSYSTEM%20%0A%20%0AException%20information%3A%20%0A%20%20%20%20Exception%20type%3A%20DuplicateKeyException%20%0A%20%20%20%20Exception%20message%3A%20Cannot%20add%20a%20duplicate%20key.%20%20Use%20Insert%20instead%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.CacheReader.AddEntry(String%20userKey%2C%20Int32%20userPolicy%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyRepo.GetUserPolicy(String%20userKey%2C%20Int32%20traceId%2C%20Int32%26amp%3B%20userPolicy%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyEvaluator.IsBasicAuthAllowed(String%20userKey%2C%20String%20protocolName%2C%20Int32%20traceId%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.BackendRehydrationModule.IsLegacyAuthAllowed(HttpContext%20httpContext)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.BackendRehydrationModule.OnAuthenticateRequest(Object%20source%2C%20EventArgs%20args)%0A%20%20%20at%20System.Web.HttpApplication.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()%0A%20%20%20at%20System.Web.HttpApplication.ExecuteStepImpl(IExecutionStep%20step)%0A%20%20%20at%20System.Web.HttpApplication.ExecuteStep(IExecutionStep%20step%2C%20Boolean%26amp%3B%20completedSynchronously)%0A%0A%20%0A%20%0ARequest%20information%3A%20%0A%20%20%20%20Request%20URL%3A%20https%3A%2F%2F%26lt%3Bserver%26gt%3B.%26lt%3Bdomain%26gt%3B.com%3A444%2FEWS%2FExchange.asmx%20%0A%20%20%20%20Request%20path%3A%20%2FEWS%2FExchange.asmx%20%0A%20%20%20%20User%20host%20address%3A%20%26lt%3Binternal%20IP%26gt%3B%0A%20%20%20%20User%3A%20%26lt%3Bdomain%26gt%3B%5C%26lt%3Bcomputer%20name%26gt%3B%24%20%0A%20%20%20%20Is%20authenticated%3A%20True%20%0A%20%20%20%20Authentication%20Type%3A%20Negotiate%20%0A%20%20%20%20Thread%20account%20name%3A%20NT%20AUTHORITY%5CSYSTEM%20%0A%20%0AThread%20information%3A%20%0A%20%20%20%20Thread%20ID%3A%2011%20%0A%20%20%20%20Thread%20account%20name%3A%20NT%20AUTHORITY%5CSYSTEM%20%0A%20%20%20%20Is%20impersonating%3A%20False%20%0A%20%20%20%20Stack%20trace%3A%20%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.CacheReader.AddEntry(String%20userKey%2C%20Int32%20userPolicy%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyRepo.GetUserPolicy(String%20userKey%2C%20Int32%20traceId%2C%20Int32%26amp%3B%20userPolicy%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyEvaluator.IsBasicAuthAllowed(String%20userKey%2C%20String%20protocolName%2C%20Int32%20traceId%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.BackendRehydrationModule.IsLegacyAuthAllowed(HttpContext%20httpContext)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.BackendRehydrationModule.OnAuthenticateRequest(Object%20source%2C%20EventArgs%20args)%0A%20%20%20at%20System.Web.HttpApplication.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()%0A%20%20%20at%20System.Web.HttpApplication.ExecuteStepImpl(IExecutionStep%20step)%0A%20%20%20at%20System.Web.HttpApplication.ExecuteStep(IExecutionStep%20step%2C%20Boolean%26amp%3B%20completedSynchronously)%0A%20%0A%20%0ACustom%20event%20details%3A%20%0A%0AEvent%20Xml%3A%0A%26lt%3BEvent%20xmlns%3D%22http%3A%2F%2Fschemas.microsoft.com%2Fwin%2F2004%2F08%2Fevents%2Fevent%22%26gt%3B%0A%20%20%26lt%3BSystem%26gt%3B%0A%20%20%20%20%26lt%3BProvider%20Name%3D%22ASP.NET%204.0.30319.0%22%20%2F%26gt%3B%0A%20%20%20%20%26lt%3BEventID%20Qualifiers%3D%2232768%22%26gt%3B1309%26lt%3B%2FEventID%26gt%3B%0A%20%20%20%20%26lt%3BLevel%26gt%3B3%26lt%3B%2FLevel%26gt%3B%0A%20%20%20%20%26lt%3BTask%26gt%3B3%26lt%3B%2FTask%26gt%3B%0A%20%20%20%20%26lt%3BKeywords%26gt%3B0x80000000000000%26lt%3B%2FKeywords%26gt%3B%0A%20%20%20%20%26lt%3BEventRecordID%26gt%3B861141%26lt%3B%2FEventRecordID%26gt%3B%0A%20%20%20%20%26lt%3BChannel%26gt%3BApplication%26lt%3B%2FChannel%26gt%3B%0A%20%20%20%20%26lt%3BSecurity%20%2F%26gt%3B%0A%20%20%26lt%3B%2FSystem%26gt%3B%0A%20%20%26lt%3BEventData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3B3005%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3BAn%20unhandled%20exception%20has%20occurred.%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3Bf227e48f4d474111873957cee43f41ff%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3B2%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3B1%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3B0%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3B%2FLM%2FW3SVC%2F2%2FROOT%2FEWS-2-132518667113847979%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3BFull%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3B%2FEWS%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3BC%3A%5CProgram%20Files%5CMicrosoft%5CExchange%20Server%5CV15%5CClientAccess%5Cexchweb%5CEWS%5C%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3BPRD-EX05%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3B%0A%20%20%20%20%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3B12016%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3Bw3wp.exe%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3BNT%20AUTHORITY%5CSYSTEM%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3BDuplicateKeyException%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3BCannot%20add%20a%20duplicate%20key.%20%20Use%20Insert%20instead%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.CacheReader.AddEntry(String%20userKey%2C%20Int32%20userPolicy%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyRepo.GetUserPolicy(String%20userKey%2C%20Int32%20traceId%2C%20Int32%26amp%3Bamp%3B%20userPolicy%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyEvaluator.IsBasicAuthAllowed(String%20userKey%2C%20String%20protocolName%2C%20Int32%20traceId%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.BackendRehydrationModule.IsLegacyAuthAllowed(HttpContext%20httpContext)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.BackendRehydrationModule.OnAuthenticateRequest(Object%20source%2C%20EventArgs%20args)%0A%20%20%20at%20System.Web.HttpApplication.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()%0A%20%20%20at%20System.Web.HttpApplication.ExecuteStepImpl(IExecutionStep%20step)%0A%20%20%20at%20System.Web.HttpApplication.ExecuteStep(IExecutionStep%20step%2C%20Boolean%26amp%3Bamp%3B%20completedSynchronously)%0A%0A%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3Bhttps%3A%2F%2F%26lt%3Bcomputer%20name%26gt%3B.%26lt%3Bdomain%26gt%3B.com%3A444%2FEWS%2FExchange.asmx%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3B%2FEWS%2FExchange.asmx%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3B%26lt%3Binternal%20ip%26gt%3B%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3B%26lt%3Bdomain%26gt%3B%5C%26lt%3Bcomputer%20name%26gt%3B%24%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3BTrue%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3BNegotiate%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3BNT%20AUTHORITY%5CSYSTEM%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3B11%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3BNT%20AUTHORITY%5CSYSTEM%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3BFalse%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3B%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.CacheReader.AddEntry(String%20userKey%2C%20Int32%20userPolicy%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyRepo.GetUserPolicy(String%20userKey%2C%20Int32%20traceId%2C%20Int32%26amp%3Bamp%3B%20userPolicy%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyEvaluator.IsBasicAuthAllowed(String%20userKey%2C%20String%20protocolName%2C%20Int32%20traceId%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.BackendRehydrationModule.IsLegacyAuthAllowed(HttpContext%20httpContext)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.BackendRehydrationModule.OnAuthenticateRequest(Object%20source%2C%20EventArgs%20args)%0A%20%20%20at%20System.Web.HttpApplication.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()%0A%20%20%20at%20System.Web.HttpApplication.ExecuteStepImpl(IExecutionStep%20step)%0A%20%20%20at%20System.Web.HttpApplication.ExecuteStep(IExecutionStep%20step%2C%20Boolean%26amp%3Bamp%3B%20completedSynchronously)%0A%26lt%3B%2FData%26gt%3B%0A%20%20%26lt%3B%2FEventData%26gt%3B%0A%26lt%3B%2FEvent%26gt%3B%3C%2FPRE%3E%3C%2FDIV%3E%3C%2FDIV%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1965503%22%20slang%3D%22en-US%22%3ERe%3A%20Disabling%20Legacy%20Authentication%20in%20Exchange%20Server%202019%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1965503%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F149115%22%20target%3D%22_blank%22%3E%40Greg%20Taylor%20-%20EXCHANGE%3C%2FA%3E%26nbsp%3Bwhen%20I%20set%20the%20policy%20at%20the%20organization%20level%20things%20stop%20working.%20Once%20I%20execute%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CPRE%3ESet-OrganizationConfig%20-DefaultAuthenticationPolicy%20%22Block%20Legacy%20Auth%22%3C%2FPRE%3E%3CP%3Ewindows%2Fdialog%20boxes%20will%20start%20flashing%20on%20half%20of%20the%20outlook%20clients.%20It%20flashes%20fast%20and%20I%20can't%20tell%20if%20there%20is%20any%20content.%20Also%2C%20half%20the%20phones%20will%20stop%20working.%20When%20I%20set%20the%20authentication%20policy%20back%20to%20null%20everything%20starts%20working%20again%20but%20legacy%20auth%20is%20still%20enabled.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIf%20I%20set%20the%20authorization%20policy%20at%20the%20user%20level%20things%20work%20as%20you%20would%20expect.%20HMA%20seems%20to%20function%20just%20fine%20on%20the%20same%20outlook%20clients%20and%20phones%20that%20have%20an%20issue%20if%20the%20policy%20is%20set%20at%20the%20org%20level.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWe%20have%20a%202%20node%20DAG%20and%20we're%20using%20roundrobin%20DNS%20for%20load%20balancing.%20I'm%20not%20100%25%20but%20it%20seems%20to%20be%20that%20the%20clients%20have%20an%20issue%20if%20they're%20connecting%20to%20the%20node%20that%20doesn't%20house%20the%20database%20that%20their%20mailbox%20is%20on.%20I%20think%3F%20There%20isn't%20anything%20that%20needs%20to%20be%20done%20to%20proxy%20the%20modern%20auth%20requests%20between%20the%20servers%20is%20there%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWhen%20I%20enabled%20the%20policy%20at%20the%20org%20level%20I%20start%20seeing%20unhandled%20exceptions%20in%20the%20event%20logs%20that%20all%20seem%20to%20point%20to%20some%20kind%20of%20duplicate%20key%20but%20I%20can't%20figure%20out%20what%20that%20duplicate%20key%20is...%20any%20thoughts%3F%20Here%20are%20some%20examples%20from%20the%20event%20log%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CPRE%3ELog%20Name%3A%20Application%0ASource%3A%20MSExchange%20Front%20End%20HTTP%20Proxy%0AEvent%20ID%3A%201003%0ATask%20Category%3A%20Core%0ALevel%3A%20Error%0AKeywords%3A%20Classic%0AUser%3A%20N%2FA%0ADescription%3A%0A%5BOwa%5D%20An%20internal%20server%20error%20occurred.%20The%20unhandled%20exception%20was%3A%20Microsoft.Exchange.Collections.TimeoutCache.DuplicateKeyException%3A%20Cannot%20add%20a%20duplicate%20key.%20Use%20Insert%20instead%0Aat%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.CacheReader.AddEntry(String%20userKey%2C%20Int32%20userPolicy%2C%20ConfigWrapper%20config)%0Aat%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyRepo.GetUserPolicy(String%20userKey%2C%20Int32%20traceId%2C%20Int32%26amp%3B%20userPolicy%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0Aat%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyEvaluator.IsBasicAuthAllowed(String%20userKey%2C%20String%20protocolName%2C%20Int32%20traceId%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0Aat%20Microsoft.Exchange.HttpProxy.ProxyModule.IsLegacyAuthAllowed(HttpApplication%20httpApplication)%0Aat%20Microsoft.Exchange.HttpProxy.ProxyModule.OnPostAuthenticateInternal(HttpApplication%20httpApplication)%0Aat%20Microsoft.Exchange.Common.IL.ILUtil.DoTryFilterCatch(Action%20tryDelegate%2C%20Func%602%20filterDelegate%2C%20Action%601%20catchDelegate)%0AEvent%20Xml%3A%0A%26lt%3BEvent%20xmlns%3D%22http%3A%2F%2Fschemas.microsoft.com%2Fwin%2F2004%2F08%2Fevents%2Fevent%22%26gt%3B%0A%26lt%3BSystem%26gt%3B%0A%26lt%3BProvider%20Name%3D%22MSExchange%20Front%20End%20HTTP%20Proxy%22%20%2F%26gt%3B%0A%26lt%3BEventID%20Qualifiers%3D%2249152%22%26gt%3B1003%26lt%3B%2FEventID%26gt%3B%0A%26lt%3BLevel%26gt%3B2%26lt%3B%2FLevel%26gt%3B%0A%26lt%3BTask%26gt%3B1%26lt%3B%2FTask%26gt%3B%0A%26lt%3BKeywords%26gt%3B0x80000000000000%26lt%3B%2FKeywords%26gt%3B%0A%26lt%3BEventRecordID%26gt%3B861239%26lt%3B%2FEventRecordID%26gt%3B%0A%26lt%3BChannel%26gt%3BApplication%26lt%3B%2FChannel%26gt%3B%0A%26lt%3BSecurity%20%2F%26gt%3B%0A%26lt%3B%2FSystem%26gt%3B%0A%26lt%3BEventData%26gt%3B%0A%26lt%3BData%26gt%3BOwa%26lt%3B%2FData%26gt%3B%0A%26lt%3BData%26gt%3BMicrosoft.Exchange.Collections.TimeoutCache.DuplicateKeyException%3A%20Cannot%20add%20a%20duplicate%20key.%20Use%20Insert%20instead%0Aat%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.CacheReader.AddEntry(String%20userKey%2C%20Int32%20userPolicy%2C%20ConfigWrapper%20config)%0Aat%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyRepo.GetUserPolicy(String%20userKey%2C%20Int32%20traceId%2C%20Int32%26amp%3Bamp%3B%20userPolicy%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0Aat%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyEvaluator.IsBasicAuthAllowed(String%20userKey%2C%20String%20protocolName%2C%20Int32%20traceId%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0Aat%20Microsoft.Exchange.HttpProxy.ProxyModule.IsLegacyAuthAllowed(HttpApplication%20httpApplication)%0Aat%20Microsoft.Exchange.HttpProxy.ProxyModule.OnPostAuthenticateInternal(HttpApplication%20httpApplication)%0Aat%20Microsoft.Exchange.Common.IL.ILUtil.DoTryFilterCatch(Action%20tryDelegate%2C%20Func%602%20filterDelegate%2C%20Action%601%20catchDelegate)%26lt%3B%2FData%26gt%3B%0A%26lt%3B%2FEventData%26gt%3B%0A%26lt%3B%2FEvent%26gt%3B%3C%2FPRE%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CDIV%3E%3CDIV%3E%3CPRE%3ELog%20Name%3A%20%20%20%20%20%20Application%0ASource%3A%20%20%20%20%20%20%20%20MSExchange%20Autodiscover%0AEvent%20ID%3A%20%20%20%20%20%201%0ATask%20Category%3A%20Web%0ALevel%3A%20%20%20%20%20%20%20%20%20Error%0AKeywords%3A%20%20%20%20%20%20Classic%0AUser%3A%20%20%20%20%20%20%20%20%20%20N%2FA%0ADescription%3A%0AUnhandled%20Exception%20%22Cannot%20add%20a%20duplicate%20key.%20%20Use%20Insert%20instead%22%0AStack%20trace%3A%20%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.CacheReader.AddEntry(String%20userKey%2C%20Int32%20userPolicy%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyRepo.GetUserPolicy(String%20userKey%2C%20Int32%20traceId%2C%20Int32%26amp%3B%20userPolicy%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyEvaluator.IsBasicAuthAllowed(String%20userKey%2C%20String%20protocolName%2C%20Int32%20traceId%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.BackendRehydrationModule.IsLegacyAuthAllowed(HttpContext%20httpContext)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.BackendRehydrationModule.OnAuthenticateRequest(Object%20source%2C%20EventArgs%20args)%0A%20%20%20at%20System.Web.HttpApplication.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()%0A%20%20%20at%20System.Web.HttpApplication.ExecuteStepImpl(IExecutionStep%20step)%0A%20%20%20at%20System.Web.HttpApplication.ExecuteStep(IExecutionStep%20step%2C%20Boolean%26amp%3B%20completedSynchronously)%0AEvent%20Xml%3A%0A%26lt%3BEvent%20xmlns%3D%22http%3A%2F%2Fschemas.microsoft.com%2Fwin%2F2004%2F08%2Fevents%2Fevent%22%26gt%3B%0A%20%20%26lt%3BSystem%26gt%3B%0A%20%20%20%20%26lt%3BProvider%20Name%3D%22MSExchange%20Autodiscover%22%20%2F%26gt%3B%0A%20%20%20%20%26lt%3BEventID%20Qualifiers%3D%2249152%22%26gt%3B1%26lt%3B%2FEventID%26gt%3B%0A%20%20%20%20%26lt%3BLevel%26gt%3B2%26lt%3B%2FLevel%26gt%3B%0A%20%20%20%20%26lt%3BTask%26gt%3B2%26lt%3B%2FTask%26gt%3B%0A%20%20%20%20%26lt%3BKeywords%26gt%3B0x80000000000000%26lt%3B%2FKeywords%26gt%3B%0A%20%20%20%20%26lt%3BEventRecordID%26gt%3B861169%26lt%3B%2FEventRecordID%26gt%3B%0A%20%20%20%20%26lt%3BChannel%26gt%3BApplication%26lt%3B%2FChannel%26gt%3B%0A%20%20%20%20%26lt%3BSecurity%20%2F%26gt%3B%0A%20%20%26lt%3B%2FSystem%26gt%3B%0A%20%20%26lt%3BEventData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3BCannot%20add%20a%20duplicate%20key.%20%20Use%20Insert%20instead%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3B%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.CacheReader.AddEntry(String%20userKey%2C%20Int32%20userPolicy%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyRepo.GetUserPolicy(String%20userKey%2C%20Int32%20traceId%2C%20Int32%26amp%3Bamp%3B%20userPolicy%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyEvaluator.IsBasicAuthAllowed(String%20userKey%2C%20String%20protocolName%2C%20Int32%20traceId%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.BackendRehydrationModule.IsLegacyAuthAllowed(HttpContext%20httpContext)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.BackendRehydrationModule.OnAuthenticateRequest(Object%20source%2C%20EventArgs%20args)%0A%20%20%20at%20System.Web.HttpApplication.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()%0A%20%20%20at%20System.Web.HttpApplication.ExecuteStepImpl(IExecutionStep%20step)%0A%20%20%20at%20System.Web.HttpApplication.ExecuteStep(IExecutionStep%20step%2C%20Boolean%26amp%3Bamp%3B%20completedSynchronously)%26lt%3B%2FData%26gt%3B%0A%20%20%26lt%3B%2FEventData%26gt%3B%0A%26lt%3B%2FEvent%26gt%3B%3C%2FPRE%3E%3CPRE%3ELog%20Name%3A%20%20%20%20%20%20Application%0ASource%3A%20%20%20%20%20%20%20%20MSExchange%20Front%20End%20HTTP%20Proxy%0AEvent%20ID%3A%20%20%20%20%20%201003%0ATask%20Category%3A%20Core%0ALevel%3A%20%20%20%20%20%20%20%20%20Error%0AKeywords%3A%20%20%20%20%20%20Classic%0AUser%3A%20%20%20%20%20%20%20%20%20%20N%2FA%0ADescription%3A%0A%5BEws%5D%20An%20internal%20server%20error%20occurred.%20The%20unhandled%20exception%20was%3A%20Microsoft.Exchange.Collections.TimeoutCache.DuplicateKeyException%3A%20Cannot%20add%20a%20duplicate%20key.%20%20Use%20Insert%20instead%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.CacheReader.AddEntry(String%20userKey%2C%20Int32%20userPolicy%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyRepo.GetUserPolicy(String%20userKey%2C%20Int32%20traceId%2C%20Int32%26amp%3B%20userPolicy%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyEvaluator.IsBasicAuthAllowed(String%20userKey%2C%20String%20protocolName%2C%20Int32%20traceId%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.HttpProxy.ProxyModule.IsLegacyAuthAllowed(HttpApplication%20httpApplication)%0A%20%20%20at%20Microsoft.Exchange.HttpProxy.ProxyModule.OnPostAuthenticateInternal(HttpApplication%20httpApplication)%0A%20%20%20at%20Microsoft.Exchange.Common.IL.ILUtil.DoTryFilterCatch(Action%20tryDelegate%2C%20Func%602%20filterDelegate%2C%20Action%601%20catchDelegate)%0AEvent%20Xml%3A%0A%26lt%3BEvent%20xmlns%3D%22http%3A%2F%2Fschemas.microsoft.com%2Fwin%2F2004%2F08%2Fevents%2Fevent%22%26gt%3B%0A%20%20%26lt%3BSystem%26gt%3B%0A%20%20%20%20%26lt%3BProvider%20Name%3D%22MSExchange%20Front%20End%20HTTP%20Proxy%22%20%2F%26gt%3B%0A%20%20%20%20%26lt%3BEventID%20Qualifiers%3D%2249152%22%26gt%3B1003%26lt%3B%2FEventID%26gt%3B%0A%20%20%20%20%26lt%3BLevel%26gt%3B2%26lt%3B%2FLevel%26gt%3B%0A%20%20%20%20%26lt%3BTask%26gt%3B1%26lt%3B%2FTask%26gt%3B%0A%20%20%20%20%26lt%3BKeywords%26gt%3B0x80000000000000%26lt%3B%2FKeywords%26gt%3B%0A%20%20%20%20%26lt%3BEventRecordID%26gt%3B861163%26lt%3B%2FEventRecordID%26gt%3B%0A%20%20%20%20%26lt%3BChannel%26gt%3BApplication%26lt%3B%2FChannel%26gt%3B%0A%20%20%20%20%26lt%3BSecurity%20%2F%26gt%3B%0A%20%20%26lt%3B%2FSystem%26gt%3B%0A%20%20%26lt%3BEventData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3BEws%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3BMicrosoft.Exchange.Collections.TimeoutCache.DuplicateKeyException%3A%20Cannot%20add%20a%20duplicate%20key.%20%20Use%20Insert%20instead%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.CacheReader.AddEntry(String%20userKey%2C%20Int32%20userPolicy%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyRepo.GetUserPolicy(String%20userKey%2C%20Int32%20traceId%2C%20Int32%26amp%3Bamp%3B%20userPolicy%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyEvaluator.IsBasicAuthAllowed(String%20userKey%2C%20String%20protocolName%2C%20Int32%20traceId%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.HttpProxy.ProxyModule.IsLegacyAuthAllowed(HttpApplication%20httpApplication)%0A%20%20%20at%20Microsoft.Exchange.HttpProxy.ProxyModule.OnPostAuthenticateInternal(HttpApplication%20httpApplication)%0A%20%20%20at%20Microsoft.Exchange.Common.IL.ILUtil.DoTryFilterCatch(Action%20tryDelegate%2C%20Func%602%20filterDelegate%2C%20Action%601%20catchDelegate)%26lt%3B%2FData%26gt%3B%0A%20%20%26lt%3B%2FEventData%26gt%3B%0A%26lt%3B%2FEvent%26gt%3B%3C%2FPRE%3E%3CPRE%3ELog%20Name%3A%20%20%20%20%20%20Application%0ASource%3A%20%20%20%20%20%20%20%20ASP.NET%204.0.30319.0%0AEvent%20ID%3A%20%20%20%20%20%201309%0ATask%20Category%3A%20Web%20Event%0ALevel%3A%20%20%20%20%20%20%20%20%20Warning%0AKeywords%3A%20%20%20%20%20%20Classic%0AUser%3A%20%20%20%20%20%20%20%20%20%20N%2FA%0ADescription%3A%0AEvent%20code%3A%203005%20%0AEvent%20message%3A%20An%20unhandled%20exception%20has%20occurred.%20%0AEvent%20ID%3A%20f227e48f4d474111873957cee43f41ff%20%0AEvent%20sequence%3A%202%20%0AEvent%20occurrence%3A%201%20%0AEvent%20detail%20code%3A%200%20%0A%20%0AApplication%20information%3A%20%0A%20%20%20%20Application%20domain%3A%20%2FLM%2FW3SVC%2F2%2FROOT%2FEWS-2-132518667113847979%20%0A%20%20%20%20Trust%20level%3A%20Full%20%0A%20%20%20%20Application%20Virtual%20Path%3A%20%2FEWS%20%0A%20%20%20%20Application%20Path%3A%20C%3A%5CProgram%20Files%5CMicrosoft%5CExchange%20Server%5CV15%5CClientAccess%5Cexchweb%5CEWS%5C%20%0A%20%0AProcess%20information%3A%20%0A%20%20%20%20Process%20ID%3A%2012016%20%0A%20%20%20%20Process%20name%3A%20w3wp.exe%20%0A%20%20%20%20Account%20name%3A%20NT%20AUTHORITY%5CSYSTEM%20%0A%20%0AException%20information%3A%20%0A%20%20%20%20Exception%20type%3A%20DuplicateKeyException%20%0A%20%20%20%20Exception%20message%3A%20Cannot%20add%20a%20duplicate%20key.%20%20Use%20Insert%20instead%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.CacheReader.AddEntry(String%20userKey%2C%20Int32%20userPolicy%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyRepo.GetUserPolicy(String%20userKey%2C%20Int32%20traceId%2C%20Int32%26amp%3B%20userPolicy%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyEvaluator.IsBasicAuthAllowed(String%20userKey%2C%20String%20protocolName%2C%20Int32%20traceId%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.BackendRehydrationModule.IsLegacyAuthAllowed(HttpContext%20httpContext)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.BackendRehydrationModule.OnAuthenticateRequest(Object%20source%2C%20EventArgs%20args)%0A%20%20%20at%20System.Web.HttpApplication.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()%0A%20%20%20at%20System.Web.HttpApplication.ExecuteStepImpl(IExecutionStep%20step)%0A%20%20%20at%20System.Web.HttpApplication.ExecuteStep(IExecutionStep%20step%2C%20Boolean%26amp%3B%20completedSynchronously)%0A%0A%20%0A%20%0ARequest%20information%3A%20%0A%20%20%20%20Request%20URL%3A%20https%3A%2F%2F%26lt%3Bserver%26gt%3B.%26lt%3Bdomain%26gt%3B.com%3A444%2FEWS%2FExchange.asmx%20%0A%20%20%20%20Request%20path%3A%20%2FEWS%2FExchange.asmx%20%0A%20%20%20%20User%20host%20address%3A%20%26lt%3Binternal%20IP%26gt%3B%0A%20%20%20%20User%3A%20%26lt%3Bdomain%26gt%3B%5C%26lt%3Bcomputer%20name%26gt%3B%24%20%0A%20%20%20%20Is%20authenticated%3A%20True%20%0A%20%20%20%20Authentication%20Type%3A%20Negotiate%20%0A%20%20%20%20Thread%20account%20name%3A%20NT%20AUTHORITY%5CSYSTEM%20%0A%20%0AThread%20information%3A%20%0A%20%20%20%20Thread%20ID%3A%2011%20%0A%20%20%20%20Thread%20account%20name%3A%20NT%20AUTHORITY%5CSYSTEM%20%0A%20%20%20%20Is%20impersonating%3A%20False%20%0A%20%20%20%20Stack%20trace%3A%20%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.CacheReader.AddEntry(String%20userKey%2C%20Int32%20userPolicy%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyRepo.GetUserPolicy(String%20userKey%2C%20Int32%20traceId%2C%20Int32%26amp%3B%20userPolicy%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyEvaluator.IsBasicAuthAllowed(String%20userKey%2C%20String%20protocolName%2C%20Int32%20traceId%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.BackendRehydrationModule.IsLegacyAuthAllowed(HttpContext%20httpContext)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.BackendRehydrationModule.OnAuthenticateRequest(Object%20source%2C%20EventArgs%20args)%0A%20%20%20at%20System.Web.HttpApplication.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()%0A%20%20%20at%20System.Web.HttpApplication.ExecuteStepImpl(IExecutionStep%20step)%0A%20%20%20at%20System.Web.HttpApplication.ExecuteStep(IExecutionStep%20step%2C%20Boolean%26amp%3B%20completedSynchronously)%0A%20%0A%20%0ACustom%20event%20details%3A%20%0A%0AEvent%20Xml%3A%0A%26lt%3BEvent%20xmlns%3D%22http%3A%2F%2Fschemas.microsoft.com%2Fwin%2F2004%2F08%2Fevents%2Fevent%22%26gt%3B%0A%20%20%26lt%3BSystem%26gt%3B%0A%20%20%20%20%26lt%3BProvider%20Name%3D%22ASP.NET%204.0.30319.0%22%20%2F%26gt%3B%0A%20%20%20%20%26lt%3BEventID%20Qualifiers%3D%2232768%22%26gt%3B1309%26lt%3B%2FEventID%26gt%3B%0A%20%20%20%20%26lt%3BLevel%26gt%3B3%26lt%3B%2FLevel%26gt%3B%0A%20%20%20%20%26lt%3BTask%26gt%3B3%26lt%3B%2FTask%26gt%3B%0A%20%20%20%20%26lt%3BKeywords%26gt%3B0x80000000000000%26lt%3B%2FKeywords%26gt%3B%0A%20%20%20%20%26lt%3BEventRecordID%26gt%3B861141%26lt%3B%2FEventRecordID%26gt%3B%0A%20%20%20%20%26lt%3BChannel%26gt%3BApplication%26lt%3B%2FChannel%26gt%3B%0A%20%20%20%20%26lt%3BSecurity%20%2F%26gt%3B%0A%20%20%26lt%3B%2FSystem%26gt%3B%0A%20%20%26lt%3BEventData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3B3005%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3BAn%20unhandled%20exception%20has%20occurred.%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3Bf227e48f4d474111873957cee43f41ff%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3B2%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3B1%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3B0%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3B%2FLM%2FW3SVC%2F2%2FROOT%2FEWS-2-132518667113847979%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3BFull%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3B%2FEWS%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3BC%3A%5CProgram%20Files%5CMicrosoft%5CExchange%20Server%5CV15%5CClientAccess%5Cexchweb%5CEWS%5C%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3B%26lt%3Bcomputer%20name%26gt%3B%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3B%0A%20%20%20%20%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3B12016%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3Bw3wp.exe%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3BNT%20AUTHORITY%5CSYSTEM%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3BDuplicateKeyException%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3BCannot%20add%20a%20duplicate%20key.%20%20Use%20Insert%20instead%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.CacheReader.AddEntry(String%20userKey%2C%20Int32%20userPolicy%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyRepo.GetUserPolicy(String%20userKey%2C%20Int32%20traceId%2C%20Int32%26amp%3Bamp%3B%20userPolicy%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyEvaluator.IsBasicAuthAllowed(String%20userKey%2C%20String%20protocolName%2C%20Int32%20traceId%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.BackendRehydrationModule.IsLegacyAuthAllowed(HttpContext%20httpContext)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.BackendRehydrationModule.OnAuthenticateRequest(Object%20source%2C%20EventArgs%20args)%0A%20%20%20at%20System.Web.HttpApplication.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()%0A%20%20%20at%20System.Web.HttpApplication.ExecuteStepImpl(IExecutionStep%20step)%0A%20%20%20at%20System.Web.HttpApplication.ExecuteStep(IExecutionStep%20step%2C%20Boolean%26amp%3Bamp%3B%20completedSynchronously)%0A%0A%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3Bhttps%3A%2F%2F%26lt%3Bcomputer%20name%26gt%3B.%26lt%3Bdomain%26gt%3B.com%3A444%2FEWS%2FExchange.asmx%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3B%2FEWS%2FExchange.asmx%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3B%26lt%3Binternal%20ip%26gt%3B%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3B%26lt%3Bdomain%26gt%3B%5C%26lt%3Bcomputer%20name%26gt%3B%24%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3BTrue%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3BNegotiate%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3BNT%20AUTHORITY%5CSYSTEM%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3B11%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3BNT%20AUTHORITY%5CSYSTEM%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3BFalse%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3B%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.CacheReader.AddEntry(String%20userKey%2C%20Int32%20userPolicy%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyRepo.GetUserPolicy(String%20userKey%2C%20Int32%20traceId%2C%20Int32%26amp%3Bamp%3B%20userPolicy%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyEvaluator.IsBasicAuthAllowed(String%20userKey%2C%20String%20protocolName%2C%20Int32%20traceId%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.BackendRehydrationModule.IsLegacyAuthAllowed(HttpContext%20httpContext)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.BackendRehydrationModule.OnAuthenticateRequest(Object%20source%2C%20EventArgs%20args)%0A%20%20%20at%20System.Web.HttpApplication.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()%0A%20%20%20at%20System.Web.HttpApplication.ExecuteStepImpl(IExecutionStep%20step)%0A%20%20%20at%20System.Web.HttpApplication.ExecuteStep(IExecutionStep%20step%2C%20Boolean%26amp%3Bamp%3B%20completedSynchronously)%0A%26lt%3B%2FData%26gt%3B%0A%20%20%26lt%3B%2FEventData%26gt%3B%0A%26lt%3B%2FEvent%26gt%3B%3C%2FPRE%3E%3C%2FDIV%3E%3C%2FDIV%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1965521%22%20slang%3D%22en-US%22%3ERe%3A%20Disabling%20Legacy%20Authentication%20in%20Exchange%20Server%202019%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1965521%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F149115%22%20target%3D%22_blank%22%3E%40Greg%20Taylor%20-%20EXCHANGE%3C%2FA%3E%26nbsp%3Bwhen%20I%20set%20the%20policy%20at%20the%20organization%20level%20things%20stop%20working.%20Once%20I%20execute%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CPRE%3ESet-OrganizationConfig%20-DefaultAuthenticationPolicy%20%22Block%20Legacy%20Auth%22%3C%2FPRE%3E%3CP%3Ewindows%2Fdialog%20boxes%20will%20start%20flashing%20on%20half%20of%20the%20outlook%20clients.%20It%20flashes%20fast%20and%20I%20can't%20tell%20if%20there%20is%20any%20content.%20Also%2C%20half%20the%20phones%20will%20stop%20working.%20When%20I%20set%20the%20authentication%20policy%20back%20to%20null%20everything%20starts%20working%20again%20but%20legacy%20auth%20is%20still%20enabled.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIf%20I%20set%20the%20authentication%20policy%20at%20the%20user%20level%20things%20work%20as%20you%20would%20expect.%20HMA%20seems%20to%20function%20just%20fine%20on%20the%20same%20outlook%20clients%20and%20phones%20that%20have%20an%20issue%20if%20the%20policy%20is%20set%20at%20the%20org%20level.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWe%20have%20a%202%20node%20DAG%20and%20we're%20using%20roundrobin%20DNS%20for%20load%20balancing.%20I'm%20not%20100%25%20but%20it%20seems%20to%20be%20that%20the%20clients%20have%20an%20issue%20if%20they're%20connecting%20to%20the%20node%20that%20doesn't%20house%20the%20database%20that%20their%20mailbox%20is%20on.%20I%20think%3F%20There%20isn't%20anything%20that%20needs%20to%20be%20done%20to%20proxy%20the%20modern%20auth%20requests%20between%20the%20servers%20is%20there%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWhen%20I%20enabled%20the%20policy%20at%20the%20org%20level%20I%20start%20seeing%20unhandled%20exceptions%20in%20the%20event%20logs%20that%20all%20seem%20to%20point%20to%20some%20kind%20of%20duplicate%20key%20but%20I%20can't%20figure%20out%20what%20that%20duplicate%20key%20is...%20any%20thoughts%3F%20Here%20are%20some%20examples%20from%20the%20event%20log%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CPRE%3ELog%20Name%3A%20Application%0ASource%3A%20MSExchange%20Front%20End%20HTTP%20Proxy%0AEvent%20ID%3A%201003%0ATask%20Category%3A%20Core%0ALevel%3A%20Error%0AKeywords%3A%20Classic%0AUser%3A%20N%2FA%0ADescription%3A%0A%5BOwa%5D%20An%20internal%20server%20error%20occurred.%20The%20unhandled%20exception%20was%3A%20Microsoft.Exchange.Collections.TimeoutCache.DuplicateKeyException%3A%20Cannot%20add%20a%20duplicate%20key.%20Use%20Insert%20instead%0Aat%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.CacheReader.AddEntry(String%20userKey%2C%20Int32%20userPolicy%2C%20ConfigWrapper%20config)%0Aat%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyRepo.GetUserPolicy(String%20userKey%2C%20Int32%20traceId%2C%20Int32%26amp%3B%20userPolicy%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0Aat%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyEvaluator.IsBasicAuthAllowed(String%20userKey%2C%20String%20protocolName%2C%20Int32%20traceId%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0Aat%20Microsoft.Exchange.HttpProxy.ProxyModule.IsLegacyAuthAllowed(HttpApplication%20httpApplication)%0Aat%20Microsoft.Exchange.HttpProxy.ProxyModule.OnPostAuthenticateInternal(HttpApplication%20httpApplication)%0Aat%20Microsoft.Exchange.Common.IL.ILUtil.DoTryFilterCatch(Action%20tryDelegate%2C%20Func%602%20filterDelegate%2C%20Action%601%20catchDelegate)%0AEvent%20Xml%3A%0A%26lt%3BEvent%20xmlns%3D%22http%3A%2F%2Fschemas.microsoft.com%2Fwin%2F2004%2F08%2Fevents%2Fevent%22%26gt%3B%0A%26lt%3BSystem%26gt%3B%0A%26lt%3BProvider%20Name%3D%22MSExchange%20Front%20End%20HTTP%20Proxy%22%20%2F%26gt%3B%0A%26lt%3BEventID%20Qualifiers%3D%2249152%22%26gt%3B1003%26lt%3B%2FEventID%26gt%3B%0A%26lt%3BLevel%26gt%3B2%26lt%3B%2FLevel%26gt%3B%0A%26lt%3BTask%26gt%3B1%26lt%3B%2FTask%26gt%3B%0A%26lt%3BKeywords%26gt%3B0x80000000000000%26lt%3B%2FKeywords%26gt%3B%0A%26lt%3BEventRecordID%26gt%3B861239%26lt%3B%2FEventRecordID%26gt%3B%0A%26lt%3BChannel%26gt%3BApplication%26lt%3B%2FChannel%26gt%3B%0A%26lt%3BSecurity%20%2F%26gt%3B%0A%26lt%3B%2FSystem%26gt%3B%0A%26lt%3BEventData%26gt%3B%0A%26lt%3BData%26gt%3BOwa%26lt%3B%2FData%26gt%3B%0A%26lt%3BData%26gt%3BMicrosoft.Exchange.Collections.TimeoutCache.DuplicateKeyException%3A%20Cannot%20add%20a%20duplicate%20key.%20Use%20Insert%20instead%0Aat%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.CacheReader.AddEntry(String%20userKey%2C%20Int32%20userPolicy%2C%20ConfigWrapper%20config)%0Aat%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyRepo.GetUserPolicy(String%20userKey%2C%20Int32%20traceId%2C%20Int32%26amp%3Bamp%3B%20userPolicy%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0Aat%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyEvaluator.IsBasicAuthAllowed(String%20userKey%2C%20String%20protocolName%2C%20Int32%20traceId%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0Aat%20Microsoft.Exchange.HttpProxy.ProxyModule.IsLegacyAuthAllowed(HttpApplication%20httpApplication)%0Aat%20Microsoft.Exchange.HttpProxy.ProxyModule.OnPostAuthenticateInternal(HttpApplication%20httpApplication)%0Aat%20Microsoft.Exchange.Common.IL.ILUtil.DoTryFilterCatch(Action%20tryDelegate%2C%20Func%602%20filterDelegate%2C%20Action%601%20catchDelegate)%26lt%3B%2FData%26gt%3B%0A%26lt%3B%2FEventData%26gt%3B%0A%26lt%3B%2FEvent%26gt%3B%3C%2FPRE%3E%3CDIV%3E%3CDIV%3E%3CPRE%3ELog%20Name%3A%20%20%20%20%20%20Application%0ASource%3A%20%20%20%20%20%20%20%20MSExchange%20Autodiscover%0AEvent%20ID%3A%20%20%20%20%20%201%0ATask%20Category%3A%20Web%0ALevel%3A%20%20%20%20%20%20%20%20%20Error%0AKeywords%3A%20%20%20%20%20%20Classic%0AUser%3A%20%20%20%20%20%20%20%20%20%20N%2FA%0ADescription%3A%0AUnhandled%20Exception%20%22Cannot%20add%20a%20duplicate%20key.%20%20Use%20Insert%20instead%22%0AStack%20trace%3A%20%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.CacheReader.AddEntry(String%20userKey%2C%20Int32%20userPolicy%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyRepo.GetUserPolicy(String%20userKey%2C%20Int32%20traceId%2C%20Int32%26amp%3B%20userPolicy%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyEvaluator.IsBasicAuthAllowed(String%20userKey%2C%20String%20protocolName%2C%20Int32%20traceId%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.BackendRehydrationModule.IsLegacyAuthAllowed(HttpContext%20httpContext)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.BackendRehydrationModule.OnAuthenticateRequest(Object%20source%2C%20EventArgs%20args)%0A%20%20%20at%20System.Web.HttpApplication.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()%0A%20%20%20at%20System.Web.HttpApplication.ExecuteStepImpl(IExecutionStep%20step)%0A%20%20%20at%20System.Web.HttpApplication.ExecuteStep(IExecutionStep%20step%2C%20Boolean%26amp%3B%20completedSynchronously)%0AEvent%20Xml%3A%0A%26lt%3BEvent%20xmlns%3D%22http%3A%2F%2Fschemas.microsoft.com%2Fwin%2F2004%2F08%2Fevents%2Fevent%22%26gt%3B%0A%20%20%26lt%3BSystem%26gt%3B%0A%20%20%20%20%26lt%3BProvider%20Name%3D%22MSExchange%20Autodiscover%22%20%2F%26gt%3B%0A%20%20%20%20%26lt%3BEventID%20Qualifiers%3D%2249152%22%26gt%3B1%26lt%3B%2FEventID%26gt%3B%0A%20%20%20%20%26lt%3BLevel%26gt%3B2%26lt%3B%2FLevel%26gt%3B%0A%20%20%20%20%26lt%3BTask%26gt%3B2%26lt%3B%2FTask%26gt%3B%0A%20%20%20%20%26lt%3BKeywords%26gt%3B0x80000000000000%26lt%3B%2FKeywords%26gt%3B%0A%20%20%20%20%26lt%3BEventRecordID%26gt%3B861169%26lt%3B%2FEventRecordID%26gt%3B%0A%20%20%20%20%26lt%3BChannel%26gt%3BApplication%26lt%3B%2FChannel%26gt%3B%0A%20%20%20%20%26lt%3BSecurity%20%2F%26gt%3B%0A%20%20%26lt%3B%2FSystem%26gt%3B%0A%20%20%26lt%3BEventData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3BCannot%20add%20a%20duplicate%20key.%20%20Use%20Insert%20instead%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3B%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.CacheReader.AddEntry(String%20userKey%2C%20Int32%20userPolicy%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyRepo.GetUserPolicy(String%20userKey%2C%20Int32%20traceId%2C%20Int32%26amp%3Bamp%3B%20userPolicy%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyEvaluator.IsBasicAuthAllowed(String%20userKey%2C%20String%20protocolName%2C%20Int32%20traceId%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.BackendRehydrationModule.IsLegacyAuthAllowed(HttpContext%20httpContext)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.BackendRehydrationModule.OnAuthenticateRequest(Object%20source%2C%20EventArgs%20args)%0A%20%20%20at%20System.Web.HttpApplication.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()%0A%20%20%20at%20System.Web.HttpApplication.ExecuteStepImpl(IExecutionStep%20step)%0A%20%20%20at%20System.Web.HttpApplication.ExecuteStep(IExecutionStep%20step%2C%20Boolean%26amp%3Bamp%3B%20completedSynchronously)%26lt%3B%2FData%26gt%3B%0A%20%20%26lt%3B%2FEventData%26gt%3B%0A%26lt%3B%2FEvent%26gt%3B%3C%2FPRE%3E%3CPRE%3ELog%20Name%3A%20%20%20%20%20%20Application%0ASource%3A%20%20%20%20%20%20%20%20MSExchange%20Front%20End%20HTTP%20Proxy%0AEvent%20ID%3A%20%20%20%20%20%201003%0ATask%20Category%3A%20Core%0ALevel%3A%20%20%20%20%20%20%20%20%20Error%0AKeywords%3A%20%20%20%20%20%20Classic%0AUser%3A%20%20%20%20%20%20%20%20%20%20N%2FA%0ADescription%3A%0A%5BEws%5D%20An%20internal%20server%20error%20occurred.%20The%20unhandled%20exception%20was%3A%20Microsoft.Exchange.Collections.TimeoutCache.DuplicateKeyException%3A%20Cannot%20add%20a%20duplicate%20key.%20%20Use%20Insert%20instead%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.CacheReader.AddEntry(String%20userKey%2C%20Int32%20userPolicy%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyRepo.GetUserPolicy(String%20userKey%2C%20Int32%20traceId%2C%20Int32%26amp%3B%20userPolicy%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyEvaluator.IsBasicAuthAllowed(String%20userKey%2C%20String%20protocolName%2C%20Int32%20traceId%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.HttpProxy.ProxyModule.IsLegacyAuthAllowed(HttpApplication%20httpApplication)%0A%20%20%20at%20Microsoft.Exchange.HttpProxy.ProxyModule.OnPostAuthenticateInternal(HttpApplication%20httpApplication)%0A%20%20%20at%20Microsoft.Exchange.Common.IL.ILUtil.DoTryFilterCatch(Action%20tryDelegate%2C%20Func%602%20filterDelegate%2C%20Action%601%20catchDelegate)%0AEvent%20Xml%3A%0A%26lt%3BEvent%20xmlns%3D%22http%3A%2F%2Fschemas.microsoft.com%2Fwin%2F2004%2F08%2Fevents%2Fevent%22%26gt%3B%0A%20%20%26lt%3BSystem%26gt%3B%0A%20%20%20%20%26lt%3BProvider%20Name%3D%22MSExchange%20Front%20End%20HTTP%20Proxy%22%20%2F%26gt%3B%0A%20%20%20%20%26lt%3BEventID%20Qualifiers%3D%2249152%22%26gt%3B1003%26lt%3B%2FEventID%26gt%3B%0A%20%20%20%20%26lt%3BLevel%26gt%3B2%26lt%3B%2FLevel%26gt%3B%0A%20%20%20%20%26lt%3BTask%26gt%3B1%26lt%3B%2FTask%26gt%3B%0A%20%20%20%20%26lt%3BKeywords%26gt%3B0x80000000000000%26lt%3B%2FKeywords%26gt%3B%0A%20%20%20%20%26lt%3BEventRecordID%26gt%3B861163%26lt%3B%2FEventRecordID%26gt%3B%0A%20%20%20%20%26lt%3BChannel%26gt%3BApplication%26lt%3B%2FChannel%26gt%3B%0A%20%20%20%20%26lt%3BSecurity%20%2F%26gt%3B%0A%20%20%26lt%3B%2FSystem%26gt%3B%0A%20%20%26lt%3BEventData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3BEws%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3BMicrosoft.Exchange.Collections.TimeoutCache.DuplicateKeyException%3A%20Cannot%20add%20a%20duplicate%20key.%20%20Use%20Insert%20instead%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.CacheReader.AddEntry(String%20userKey%2C%20Int32%20userPolicy%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyRepo.GetUserPolicy(String%20userKey%2C%20Int32%20traceId%2C%20Int32%26amp%3Bamp%3B%20userPolicy%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyEvaluator.IsBasicAuthAllowed(String%20userKey%2C%20String%20protocolName%2C%20Int32%20traceId%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.HttpProxy.ProxyModule.IsLegacyAuthAllowed(HttpApplication%20httpApplication)%0A%20%20%20at%20Microsoft.Exchange.HttpProxy.ProxyModule.OnPostAuthenticateInternal(HttpApplication%20httpApplication)%0A%20%20%20at%20Microsoft.Exchange.Common.IL.ILUtil.DoTryFilterCatch(Action%20tryDelegate%2C%20Func%602%20filterDelegate%2C%20Action%601%20catchDelegate)%26lt%3B%2FData%26gt%3B%0A%20%20%26lt%3B%2FEventData%26gt%3B%0A%26lt%3B%2FEvent%26gt%3B%3C%2FPRE%3E%3CPRE%3ELog%20Name%3A%20%20%20%20%20%20Application%0ASource%3A%20%20%20%20%20%20%20%20ASP.NET%204.0.30319.0%0AEvent%20ID%3A%20%20%20%20%20%201309%0ATask%20Category%3A%20Web%20Event%0ALevel%3A%20%20%20%20%20%20%20%20%20Warning%0AKeywords%3A%20%20%20%20%20%20Classic%0AUser%3A%20%20%20%20%20%20%20%20%20%20N%2FA%0ADescription%3A%0AEvent%20code%3A%203005%20%0AEvent%20message%3A%20An%20unhandled%20exception%20has%20occurred.%20%0AEvent%20ID%3A%20f227e48f4d474111873957cee43f41ff%20%0AEvent%20sequence%3A%202%20%0AEvent%20occurrence%3A%201%20%0AEvent%20detail%20code%3A%200%20%0A%20%0AApplication%20information%3A%20%0A%20%20%20%20Application%20domain%3A%20%2FLM%2FW3SVC%2F2%2FROOT%2FEWS-2-132518667113847979%20%0A%20%20%20%20Trust%20level%3A%20Full%20%0A%20%20%20%20Application%20Virtual%20Path%3A%20%2FEWS%20%0A%20%20%20%20Application%20Path%3A%20C%3A%5CProgram%20Files%5CMicrosoft%5CExchange%20Server%5CV15%5CClientAccess%5Cexchweb%5CEWS%5C%20%0A%20%0AProcess%20information%3A%20%0A%20%20%20%20Process%20ID%3A%2012016%20%0A%20%20%20%20Process%20name%3A%20w3wp.exe%20%0A%20%20%20%20Account%20name%3A%20NT%20AUTHORITY%5CSYSTEM%20%0A%20%0AException%20information%3A%20%0A%20%20%20%20Exception%20type%3A%20DuplicateKeyException%20%0A%20%20%20%20Exception%20message%3A%20Cannot%20add%20a%20duplicate%20key.%20%20Use%20Insert%20instead%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.CacheReader.AddEntry(String%20userKey%2C%20Int32%20userPolicy%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyRepo.GetUserPolicy(String%20userKey%2C%20Int32%20traceId%2C%20Int32%26amp%3B%20userPolicy%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyEvaluator.IsBasicAuthAllowed(String%20userKey%2C%20String%20protocolName%2C%20Int32%20traceId%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.BackendRehydrationModule.IsLegacyAuthAllowed(HttpContext%20httpContext)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.BackendRehydrationModule.OnAuthenticateRequest(Object%20source%2C%20EventArgs%20args)%0A%20%20%20at%20System.Web.HttpApplication.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()%0A%20%20%20at%20System.Web.HttpApplication.ExecuteStepImpl(IExecutionStep%20step)%0A%20%20%20at%20System.Web.HttpApplication.ExecuteStep(IExecutionStep%20step%2C%20Boolean%26amp%3B%20completedSynchronously)%0A%0ARequest%20information%3A%20%0A%20%20%20%20Request%20URL%3A%20%3CA%20href%3D%22https%3A%2F%2F%26lt%3Bcomputer%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3Ehttps%3A%2F%2F%3CCOMPUTER%3E%3C%2FCOMPUTER%3E%3C%2FA%3E%20name%26gt%3B.%26lt%3Bdomain%26gt%3B.com%3A444%2FEWS%2FExchange.asmx%20%0A%20%20%20%20Request%20path%3A%20%2FEWS%2FExchange.asmx%20%0A%20%20%20%20User%20host%20address%3A%20%26lt%3Binternal%20IP%26gt%3B%0A%20%20%20%20User%3A%20%26lt%3Bdomain%26gt%3B%5C%26lt%3Bcomputer%20name%26gt%3B%24%20%0A%20%20%20%20Is%20authenticated%3A%20True%20%0A%20%20%20%20Authentication%20Type%3A%20Negotiate%20%0A%20%20%20%20Thread%20account%20name%3A%20NT%20AUTHORITY%5CSYSTEM%20%0A%20%0AThread%20information%3A%20%0A%20%20%20%20Thread%20ID%3A%2011%20%0A%20%20%20%20Thread%20account%20name%3A%20NT%20AUTHORITY%5CSYSTEM%20%0A%20%20%20%20Is%20impersonating%3A%20False%20%0A%20%20%20%20Stack%20trace%3A%20%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.CacheReader.AddEntry(String%20userKey%2C%20Int32%20userPolicy%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyRepo.GetUserPolicy(String%20userKey%2C%20Int32%20traceId%2C%20Int32%26amp%3B%20userPolicy%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyEvaluator.IsBasicAuthAllowed(String%20userKey%2C%20String%20protocolName%2C%20Int32%20traceId%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.BackendRehydrationModule.IsLegacyAuthAllowed(HttpContext%20httpContext)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.BackendRehydrationModule.OnAuthenticateRequest(Object%20source%2C%20EventArgs%20args)%0A%20%20%20at%20System.Web.HttpApplication.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()%0A%20%20%20at%20System.Web.HttpApplication.ExecuteStepImpl(IExecutionStep%20step)%0A%20%20%20at%20System.Web.HttpApplication.ExecuteStep(IExecutionStep%20step%2C%20Boolean%26amp%3B%20completedSynchronously)%0A%20%0A%20%0ACustom%20event%20details%3A%20%0A%0AEvent%20Xml%3A%0A%26lt%3BEvent%20xmlns%3D%22http%3A%2F%2Fschemas.microsoft.com%2Fwin%2F2004%2F08%2Fevents%2Fevent%22%26gt%3B%0A%20%20%26lt%3BSystem%26gt%3B%0A%20%20%20%20%26lt%3BProvider%20Name%3D%22ASP.NET%204.0.30319.0%22%20%2F%26gt%3B%0A%20%20%20%20%26lt%3BEventID%20Qualifiers%3D%2232768%22%26gt%3B1309%26lt%3B%2FEventID%26gt%3B%0A%20%20%20%20%26lt%3BLevel%26gt%3B3%26lt%3B%2FLevel%26gt%3B%0A%20%20%20%20%26lt%3BTask%26gt%3B3%26lt%3B%2FTask%26gt%3B%0A%20%20%20%20%26lt%3BKeywords%26gt%3B0x80000000000000%26lt%3B%2FKeywords%26gt%3B%0A%20%20%20%20%26lt%3BEventRecordID%26gt%3B861141%26lt%3B%2FEventRecordID%26gt%3B%0A%20%20%20%20%26lt%3BChannel%26gt%3BApplication%26lt%3B%2FChannel%26gt%3B%0A%20%20%20%20%26lt%3BSecurity%20%2F%26gt%3B%0A%20%20%26lt%3B%2FSystem%26gt%3B%0A%20%20%26lt%3BEventData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3B3005%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3BAn%20unhandled%20exception%20has%20occurred.%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3Bf227e48f4d474111873957cee43f41ff%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3B2%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3B1%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3B0%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3B%2FLM%2FW3SVC%2F2%2FROOT%2FEWS-2-132518667113847979%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3BFull%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3B%2FEWS%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3BC%3A%5CProgram%20Files%5CMicrosoft%5CExchange%20Server%5CV15%5CClientAccess%5Cexchweb%5CEWS%5C%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3B%26lt%3Bcomputer%20name%26gt%3B%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3B%0A%20%20%20%20%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3B12016%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3Bw3wp.exe%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3BNT%20AUTHORITY%5CSYSTEM%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3BDuplicateKeyException%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3BCannot%20add%20a%20duplicate%20key.%20%20Use%20Insert%20instead%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.CacheReader.AddEntry(String%20userKey%2C%20Int32%20userPolicy%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyRepo.GetUserPolicy(String%20userKey%2C%20Int32%20traceId%2C%20Int32%26amp%3Bamp%3B%20userPolicy%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyEvaluator.IsBasicAuthAllowed(String%20userKey%2C%20String%20protocolName%2C%20Int32%20traceId%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.BackendRehydrationModule.IsLegacyAuthAllowed(HttpContext%20httpContext)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.BackendRehydrationModule.OnAuthenticateRequest(Object%20source%2C%20EventArgs%20args)%0A%20%20%20at%20System.Web.HttpApplication.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()%0A%20%20%20at%20System.Web.HttpApplication.ExecuteStepImpl(IExecutionStep%20step)%0A%20%20%20at%20System.Web.HttpApplication.ExecuteStep(IExecutionStep%20step%2C%20Boolean%26amp%3Bamp%3B%20completedSynchronously)%0A%0A%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3Bhttps%3A%2F%2F%26lt%3Bcomputer%20name%26gt%3B.%26lt%3Bdomain%26gt%3B.com%3A444%2FEWS%2FExchange.asmx%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3B%2FEWS%2FExchange.asmx%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3B%26lt%3Binternal%20ip%26gt%3B%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3B%26lt%3Bdomain%26gt%3B%5C%26lt%3Bcomputer%20name%26gt%3B%24%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3BTrue%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3BNegotiate%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3BNT%20AUTHORITY%5CSYSTEM%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3B11%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3BNT%20AUTHORITY%5CSYSTEM%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3BFalse%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3B%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.CacheReader.AddEntry(String%20userKey%2C%20Int32%20userPolicy%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyRepo.GetUserPolicy(String%20userKey%2C%20Int32%20traceId%2C%20Int32%26amp%3Bamp%3B%20userPolicy%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyEvaluator.IsBasicAuthAllowed(String%20userKey%2C%20String%20protocolName%2C%20Int32%20traceId%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.BackendRehydrationModule.IsLegacyAuthAllowed(HttpContext%20httpContext)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.BackendRehydrationModule.OnAuthenticateRequest(Object%20source%2C%20EventArgs%20args)%0A%20%20%20at%20System.Web.HttpApplication.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()%0A%20%20%20at%20System.Web.HttpApplication.ExecuteStepImpl(IExecutionStep%20step)%0A%20%20%20at%20System.Web.HttpApplication.ExecuteStep(IExecutionStep%20step%2C%20Boolean%26amp%3Bamp%3B%20completedSynchronously)%0A%26lt%3B%2FData%26gt%3B%0A%20%20%26lt%3B%2FEventData%26gt%3B%0A%26lt%3B%2FEvent%26gt%3B%3C%2FPRE%3E%3C%2FDIV%3E%3C%2FDIV%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1965538%22%20slang%3D%22en-US%22%3ERe%3A%20Disabling%20Legacy%20Authentication%20in%20Exchange%20Server%202019%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1965538%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F149115%22%20target%3D%22_blank%22%3E%40Greg%20Taylor%20-%20EXCHANGE%3C%2FA%3E%26nbsp%3Bwhen%20I%20set%20the%20policy%20at%20the%20organization%20level%20things%20stop%20working.%20Once%20I%20execute%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CPRE%3ESet-OrganizationConfig%20-DefaultAuthenticationPolicy%20%22Block%20Legacy%20Auth%22%3C%2FPRE%3E%3CP%3Ewindows%2Fdialog%20boxes%20will%20start%20flashing%20on%20half%20of%20the%20outlook%20clients.%20It%20flashes%20fast%20and%20I%20can't%20tell%20if%20there%20is%20any%20content.%20Also%2C%20half%20the%20phones%20will%20stop%20working.%20When%20I%20set%20the%20authentication%20policy%20back%20to%20null%20everything%20starts%20working%20again%20but%20legacy%20auth%20is%20still%20enabled.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIf%20I%20set%20the%20authentication%20policy%20at%20the%20user%20level%20things%20work%20as%20you%20would%20expect.%20HMA%20seems%20to%20function%20just%20fine%20on%20the%20same%20outlook%20clients%20and%20phones%20that%20have%20an%20issue%20if%20the%20policy%20is%20set%20at%20the%20org%20level.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWe%20have%20a%202%20node%20DAG%20and%20we're%20using%20roundrobin%20DNS%20for%20load%20balancing.%20I'm%20not%20100%25%20but%20it%20seems%20to%20be%20that%20the%20clients%20have%20an%20issue%20if%20they're%20connecting%20to%20the%20node%20that%20doesn't%20house%20the%20database%20that%20their%20mailbox%20is%20on.%20I%20think%3F%20There%20isn't%20anything%20that%20needs%20to%20be%20done%20to%20proxy%20the%20modern%20auth%20requests%20between%20the%20servers%20is%20there%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWhen%20I%20enabled%20the%20policy%20at%20the%20org%20level%20I%20start%20seeing%20unhandled%20exceptions%20in%20the%20event%20logs%20that%20all%20seem%20to%20point%20to%20some%20kind%20of%20duplicate%20key%20but%20I%20can't%20figure%20out%20what%20that%20duplicate%20key%20is...%20any%20thoughts%3F%20Here%20are%20some%20examples%20from%20the%20event%20log%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CPRE%3ELog%20Name%3A%20Application%0ASource%3A%20MSExchange%20Front%20End%20HTTP%20Proxy%0AEvent%20ID%3A%201003%0ATask%20Category%3A%20Core%0ALevel%3A%20Error%0AKeywords%3A%20Classic%0AUser%3A%20N%2FA%0ADescription%3A%0A%5BOwa%5D%20An%20internal%20server%20error%20occurred.%20The%20unhandled%20exception%20was%3A%20Microsoft.Exchange.Collections.TimeoutCache.DuplicateKeyException%3A%20Cannot%20add%20a%20duplicate%20key.%20Use%20Insert%20instead%0Aat%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.CacheReader.AddEntry(String%20userKey%2C%20Int32%20userPolicy%2C%20ConfigWrapper%20config)%0Aat%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyRepo.GetUserPolicy(String%20userKey%2C%20Int32%20traceId%2C%20Int32%26amp%3B%20userPolicy%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0Aat%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyEvaluator.IsBasicAuthAllowed(String%20userKey%2C%20String%20protocolName%2C%20Int32%20traceId%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0Aat%20Microsoft.Exchange.HttpProxy.ProxyModule.IsLegacyAuthAllowed(HttpApplication%20httpApplication)%0Aat%20Microsoft.Exchange.HttpProxy.ProxyModule.OnPostAuthenticateInternal(HttpApplication%20httpApplication)%0Aat%20Microsoft.Exchange.Common.IL.ILUtil.DoTryFilterCatch(Action%20tryDelegate%2C%20Func%602%20filterDelegate%2C%20Action%601%20catchDelegate)%0AEvent%20Xml%3A%0A%26lt%3BEvent%20xmlns%3D%22http%3A%2F%2Fschemas.microsoft.com%2Fwin%2F2004%2F08%2Fevents%2Fevent%22%26gt%3B%0A%26lt%3BSystem%26gt%3B%0A%26lt%3BProvider%20Name%3D%22MSExchange%20Front%20End%20HTTP%20Proxy%22%20%2F%26gt%3B%0A%26lt%3BEventID%20Qualifiers%3D%2249152%22%26gt%3B1003%26lt%3B%2FEventID%26gt%3B%0A%26lt%3BLevel%26gt%3B2%26lt%3B%2FLevel%26gt%3B%0A%26lt%3BTask%26gt%3B1%26lt%3B%2FTask%26gt%3B%0A%26lt%3BKeywords%26gt%3B0x80000000000000%26lt%3B%2FKeywords%26gt%3B%0A%26lt%3BEventRecordID%26gt%3B861239%26lt%3B%2FEventRecordID%26gt%3B%0A%26lt%3BChannel%26gt%3BApplication%26lt%3B%2FChannel%26gt%3B%0A%26lt%3BSecurity%20%2F%26gt%3B%0A%26lt%3B%2FSystem%26gt%3B%0A%26lt%3BEventData%26gt%3B%0A%26lt%3BData%26gt%3BOwa%26lt%3B%2FData%26gt%3B%0A%26lt%3BData%26gt%3BMicrosoft.Exchange.Collections.TimeoutCache.DuplicateKeyException%3A%20Cannot%20add%20a%20duplicate%20key.%20Use%20Insert%20instead%0Aat%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.CacheReader.AddEntry(String%20userKey%2C%20Int32%20userPolicy%2C%20ConfigWrapper%20config)%0Aat%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyRepo.GetUserPolicy(String%20userKey%2C%20Int32%20traceId%2C%20Int32%26amp%3Bamp%3B%20userPolicy%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0Aat%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyEvaluator.IsBasicAuthAllowed(String%20userKey%2C%20String%20protocolName%2C%20Int32%20traceId%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0Aat%20Microsoft.Exchange.HttpProxy.ProxyModule.IsLegacyAuthAllowed(HttpApplication%20httpApplication)%0Aat%20Microsoft.Exchange.HttpProxy.ProxyModule.OnPostAuthenticateInternal(HttpApplication%20httpApplication)%0Aat%20Microsoft.Exchange.Common.IL.ILUtil.DoTryFilterCatch(Action%20tryDelegate%2C%20Func%602%20filterDelegate%2C%20Action%601%20catchDelegate)%26lt%3B%2FData%26gt%3B%0A%26lt%3B%2FEventData%26gt%3B%0A%26lt%3B%2FEvent%26gt%3B%3C%2FPRE%3E%3CDIV%3E%3CDIV%3E%3CPRE%3ELog%20Name%3A%20%20%20%20%20%20Application%0ASource%3A%20%20%20%20%20%20%20%20MSExchange%20Autodiscover%0AEvent%20ID%3A%20%20%20%20%20%201%0ATask%20Category%3A%20Web%0ALevel%3A%20%20%20%20%20%20%20%20%20Error%0AKeywords%3A%20%20%20%20%20%20Classic%0AUser%3A%20%20%20%20%20%20%20%20%20%20N%2FA%0ADescription%3A%0AUnhandled%20Exception%20%22Cannot%20add%20a%20duplicate%20key.%20%20Use%20Insert%20instead%22%0AStack%20trace%3A%20%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.CacheReader.AddEntry(String%20userKey%2C%20Int32%20userPolicy%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyRepo.GetUserPolicy(String%20userKey%2C%20Int32%20traceId%2C%20Int32%26amp%3B%20userPolicy%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyEvaluator.IsBasicAuthAllowed(String%20userKey%2C%20String%20protocolName%2C%20Int32%20traceId%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.BackendRehydrationModule.IsLegacyAuthAllowed(HttpContext%20httpContext)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.BackendRehydrationModule.OnAuthenticateRequest(Object%20source%2C%20EventArgs%20args)%0A%20%20%20at%20System.Web.HttpApplication.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()%0A%20%20%20at%20System.Web.HttpApplication.ExecuteStepImpl(IExecutionStep%20step)%0A%20%20%20at%20System.Web.HttpApplication.ExecuteStep(IExecutionStep%20step%2C%20Boolean%26amp%3B%20completedSynchronously)%0AEvent%20Xml%3A%0A%26lt%3BEvent%20xmlns%3D%22http%3A%2F%2Fschemas.microsoft.com%2Fwin%2F2004%2F08%2Fevents%2Fevent%22%26gt%3B%0A%20%20%26lt%3BSystem%26gt%3B%0A%20%20%20%20%26lt%3BProvider%20Name%3D%22MSExchange%20Autodiscover%22%20%2F%26gt%3B%0A%20%20%20%20%26lt%3BEventID%20Qualifiers%3D%2249152%22%26gt%3B1%26lt%3B%2FEventID%26gt%3B%0A%20%20%20%20%26lt%3BLevel%26gt%3B2%26lt%3B%2FLevel%26gt%3B%0A%20%20%20%20%26lt%3BTask%26gt%3B2%26lt%3B%2FTask%26gt%3B%0A%20%20%20%20%26lt%3BKeywords%26gt%3B0x80000000000000%26lt%3B%2FKeywords%26gt%3B%0A%20%20%20%20%26lt%3BEventRecordID%26gt%3B861169%26lt%3B%2FEventRecordID%26gt%3B%0A%20%20%20%20%26lt%3BChannel%26gt%3BApplication%26lt%3B%2FChannel%26gt%3B%0A%20%20%20%20%26lt%3BSecurity%20%2F%26gt%3B%0A%20%20%26lt%3B%2FSystem%26gt%3B%0A%20%20%26lt%3BEventData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3BCannot%20add%20a%20duplicate%20key.%20%20Use%20Insert%20instead%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3B%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.CacheReader.AddEntry(String%20userKey%2C%20Int32%20userPolicy%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyRepo.GetUserPolicy(String%20userKey%2C%20Int32%20traceId%2C%20Int32%26amp%3Bamp%3B%20userPolicy%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyEvaluator.IsBasicAuthAllowed(String%20userKey%2C%20String%20protocolName%2C%20Int32%20traceId%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.BackendRehydrationModule.IsLegacyAuthAllowed(HttpContext%20httpContext)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.BackendRehydrationModule.OnAuthenticateRequest(Object%20source%2C%20EventArgs%20args)%0A%20%20%20at%20System.Web.HttpApplication.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()%0A%20%20%20at%20System.Web.HttpApplication.ExecuteStepImpl(IExecutionStep%20step)%0A%20%20%20at%20System.Web.HttpApplication.ExecuteStep(IExecutionStep%20step%2C%20Boolean%26amp%3Bamp%3B%20completedSynchronously)%26lt%3B%2FData%26gt%3B%0A%20%20%26lt%3B%2FEventData%26gt%3B%0A%26lt%3B%2FEvent%26gt%3B%3C%2FPRE%3E%3CPRE%3ELog%20Name%3A%20%20%20%20%20%20Application%0ASource%3A%20%20%20%20%20%20%20%20MSExchange%20Front%20End%20HTTP%20Proxy%0AEvent%20ID%3A%20%20%20%20%20%201003%0ATask%20Category%3A%20Core%0ALevel%3A%20%20%20%20%20%20%20%20%20Error%0AKeywords%3A%20%20%20%20%20%20Classic%0AUser%3A%20%20%20%20%20%20%20%20%20%20N%2FA%0ADescription%3A%0A%5BEws%5D%20An%20internal%20server%20error%20occurred.%20The%20unhandled%20exception%20was%3A%20Microsoft.Exchange.Collections.TimeoutCache.DuplicateKeyException%3A%20Cannot%20add%20a%20duplicate%20key.%20%20Use%20Insert%20instead%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.CacheReader.AddEntry(String%20userKey%2C%20Int32%20userPolicy%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyRepo.GetUserPolicy(String%20userKey%2C%20Int32%20traceId%2C%20Int32%26amp%3B%20userPolicy%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyEvaluator.IsBasicAuthAllowed(String%20userKey%2C%20String%20protocolName%2C%20Int32%20traceId%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.HttpProxy.ProxyModule.IsLegacyAuthAllowed(HttpApplication%20httpApplication)%0A%20%20%20at%20Microsoft.Exchange.HttpProxy.ProxyModule.OnPostAuthenticateInternal(HttpApplication%20httpApplication)%0A%20%20%20at%20Microsoft.Exchange.Common.IL.ILUtil.DoTryFilterCatch(Action%20tryDelegate%2C%20Func%602%20filterDelegate%2C%20Action%601%20catchDelegate)%0AEvent%20Xml%3A%0A%26lt%3BEvent%20xmlns%3D%22http%3A%2F%2Fschemas.microsoft.com%2Fwin%2F2004%2F08%2Fevents%2Fevent%22%26gt%3B%0A%20%20%26lt%3BSystem%26gt%3B%0A%20%20%20%20%26lt%3BProvider%20Name%3D%22MSExchange%20Front%20End%20HTTP%20Proxy%22%20%2F%26gt%3B%0A%20%20%20%20%26lt%3BEventID%20Qualifiers%3D%2249152%22%26gt%3B1003%26lt%3B%2FEventID%26gt%3B%0A%20%20%20%20%26lt%3BLevel%26gt%3B2%26lt%3B%2FLevel%26gt%3B%0A%20%20%20%20%26lt%3BTask%26gt%3B1%26lt%3B%2FTask%26gt%3B%0A%20%20%20%20%26lt%3BKeywords%26gt%3B0x80000000000000%26lt%3B%2FKeywords%26gt%3B%0A%20%20%20%20%26lt%3BEventRecordID%26gt%3B861163%26lt%3B%2FEventRecordID%26gt%3B%0A%20%20%20%20%26lt%3BChannel%26gt%3BApplication%26lt%3B%2FChannel%26gt%3B%0A%20%20%20%20%26lt%3BSecurity%20%2F%26gt%3B%0A%20%20%26lt%3B%2FSystem%26gt%3B%0A%20%20%26lt%3BEventData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3BEws%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3BMicrosoft.Exchange.Collections.TimeoutCache.DuplicateKeyException%3A%20Cannot%20add%20a%20duplicate%20key.%20%20Use%20Insert%20instead%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.CacheReader.AddEntry(String%20userKey%2C%20Int32%20userPolicy%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyRepo.GetUserPolicy(String%20userKey%2C%20Int32%20traceId%2C%20Int32%26amp%3Bamp%3B%20userPolicy%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyEvaluator.IsBasicAuthAllowed(String%20userKey%2C%20String%20protocolName%2C%20Int32%20traceId%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.HttpProxy.ProxyModule.IsLegacyAuthAllowed(HttpApplication%20httpApplication)%0A%20%20%20at%20Microsoft.Exchange.HttpProxy.ProxyModule.OnPostAuthenticateInternal(HttpApplication%20httpApplication)%0A%20%20%20at%20Microsoft.Exchange.Common.IL.ILUtil.DoTryFilterCatch(Action%20tryDelegate%2C%20Func%602%20filterDelegate%2C%20Action%601%20catchDelegate)%26lt%3B%2FData%26gt%3B%0A%20%20%26lt%3B%2FEventData%26gt%3B%0A%26lt%3B%2FEvent%26gt%3B%3C%2FPRE%3E%3CPRE%3ELog%20Name%3A%20%20%20%20%20%20Application%0ASource%3A%20%20%20%20%20%20%20%20ASP.NET%204.0.30319.0%0AEvent%20ID%3A%20%20%20%20%20%201309%0ATask%20Category%3A%20Web%20Event%0ALevel%3A%20%20%20%20%20%20%20%20%20Warning%0AKeywords%3A%20%20%20%20%20%20Classic%0AUser%3A%20%20%20%20%20%20%20%20%20%20N%2FA%0ADescription%3A%0AEvent%20code%3A%203005%20%0AEvent%20message%3A%20An%20unhandled%20exception%20has%20occurred.%20%0AEvent%20ID%3A%20f227e48f4d474111873957cee43f41ff%20%0AEvent%20sequence%3A%202%20%0AEvent%20occurrence%3A%201%20%0AEvent%20detail%20code%3A%200%20%0A%20%0AApplication%20information%3A%20%0A%20%20%20%20Application%20domain%3A%20%2FLM%2FW3SVC%2F2%2FROOT%2FEWS-2-132518667113847979%20%0A%20%20%20%20Trust%20level%3A%20Full%20%0A%20%20%20%20Application%20Virtual%20Path%3A%20%2FEWS%20%0A%20%20%20%20Application%20Path%3A%20C%3A%5CProgram%20Files%5CMicrosoft%5CExchange%20Server%5CV15%5CClientAccess%5Cexchweb%5CEWS%5C%20%0A%20%0AProcess%20information%3A%20%0A%20%20%20%20Process%20ID%3A%2012016%20%0A%20%20%20%20Process%20name%3A%20w3wp.exe%20%0A%20%20%20%20Account%20name%3A%20NT%20AUTHORITY%5CSYSTEM%20%0A%20%0AException%20information%3A%20%0A%20%20%20%20Exception%20type%3A%20DuplicateKeyException%20%0A%20%20%20%20Exception%20message%3A%20Cannot%20add%20a%20duplicate%20key.%20%20Use%20Insert%20instead%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.CacheReader.AddEntry(String%20userKey%2C%20Int32%20userPolicy%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyRepo.GetUserPolicy(String%20userKey%2C%20Int32%20traceId%2C%20Int32%26amp%3B%20userPolicy%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyEvaluator.IsBasicAuthAllowed(String%20userKey%2C%20String%20protocolName%2C%20Int32%20traceId%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.BackendRehydrationModule.IsLegacyAuthAllowed(HttpContext%20httpContext)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.BackendRehydrationModule.OnAuthenticateRequest(Object%20source%2C%20EventArgs%20args)%0A%20%20%20at%20System.Web.HttpApplication.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()%0A%20%20%20at%20System.Web.HttpApplication.ExecuteStepImpl(IExecutionStep%20step)%0A%20%20%20at%20System.Web.HttpApplication.ExecuteStep(IExecutionStep%20step%2C%20Boolean%26amp%3B%20completedSynchronously)%0A%0A%0ARequest%20information%3A%20%0A%20%20%20%20Request%20URL%3A%20%3CA%20href%3D%22https%3A%2F%2F%26lt%3Bscomputer%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3Ehttps%3A%2F%2F%3CCOMPUTER%3E%3C%2FCOMPUTER%3E%3C%2FA%3E%20name%26gt%3B.%26lt%3Bdomain%26gt%3B.com%3A444%2FEWS%2FExchange.asmx%20%0A%20%20%20%20Request%20path%3A%20%2FEWS%2FExchange.asmx%20%0A%20%20%20%20User%20host%20address%3A%20%26lt%3Binternal%20IP%26gt%3B%0A%20%20%20%20User%3A%20%26lt%3Bdomain%26gt%3B%5C%26lt%3Bcomputer%20name%26gt%3B%24%20%0A%20%20%20%20Is%20authenticated%3A%20True%20%0A%20%20%20%20Authentication%20Type%3A%20Negotiate%20%0A%20%20%20%20Thread%20account%20name%3A%20NT%20AUTHORITY%5CSYSTEM%20%0A%20%0AThread%20information%3A%20%0A%20%20%20%20Thread%20ID%3A%2011%20%0A%20%20%20%20Thread%20account%20name%3A%20NT%20AUTHORITY%5CSYSTEM%20%0A%20%20%20%20Is%20impersonating%3A%20False%20%0A%20%20%20%20Stack%20trace%3A%20%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.CacheReader.AddEntry(String%20userKey%2C%20Int32%20userPolicy%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyRepo.GetUserPolicy(String%20userKey%2C%20Int32%20traceId%2C%20Int32%26amp%3B%20userPolicy%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyEvaluator.IsBasicAuthAllowed(String%20userKey%2C%20String%20protocolName%2C%20Int32%20traceId%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.BackendRehydrationModule.IsLegacyAuthAllowed(HttpContext%20httpContext)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.BackendRehydrationModule.OnAuthenticateRequest(Object%20source%2C%20EventArgs%20args)%0A%20%20%20at%20System.Web.HttpApplication.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()%0A%20%20%20at%20System.Web.HttpApplication.ExecuteStepImpl(IExecutionStep%20step)%0A%20%20%20at%20System.Web.HttpApplication.ExecuteStep(IExecutionStep%20step%2C%20Boolean%26amp%3B%20completedSynchronously)%0A%20%0A%20%0ACustom%20event%20details%3A%20%0A%0AEvent%20Xml%3A%0A%26lt%3BEvent%20xmlns%3D%22http%3A%2F%2Fschemas.microsoft.com%2Fwin%2F2004%2F08%2Fevents%2Fevent%22%26gt%3B%0A%20%20%26lt%3BSystem%26gt%3B%0A%20%20%20%20%26lt%3BProvider%20Name%3D%22ASP.NET%204.0.30319.0%22%20%2F%26gt%3B%0A%20%20%20%20%26lt%3BEventID%20Qualifiers%3D%2232768%22%26gt%3B1309%26lt%3B%2FEventID%26gt%3B%0A%20%20%20%20%26lt%3BLevel%26gt%3B3%26lt%3B%2FLevel%26gt%3B%0A%20%20%20%20%26lt%3BTask%26gt%3B3%26lt%3B%2FTask%26gt%3B%0A%20%20%20%20%26lt%3BKeywords%26gt%3B0x80000000000000%26lt%3B%2FKeywords%26gt%3B%0A%20%20%20%20%26lt%3BEventRecordID%26gt%3B861141%26lt%3B%2FEventRecordID%26gt%3B%0A%20%20%20%20%26lt%3BChannel%26gt%3BApplication%26lt%3B%2FChannel%26gt%3B%0A%20%20%20%20%26lt%3BSecurity%20%2F%26gt%3B%0A%20%20%26lt%3B%2FSystem%26gt%3B%0A%20%20%26lt%3BEventData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3B3005%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3BAn%20unhandled%20exception%20has%20occurred.%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3Bf227e48f4d474111873957cee43f41ff%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3B2%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3B1%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3B0%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3B%2FLM%2FW3SVC%2F2%2FROOT%2FEWS-2-132518667113847979%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3BFull%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3B%2FEWS%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3BC%3A%5CProgram%20Files%5CMicrosoft%5CExchange%20Server%5CV15%5CClientAccess%5Cexchweb%5CEWS%5C%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3B%26lt%3Bcomputer%20name%26gt%3B%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3B%0A%20%20%20%20%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3B12016%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3Bw3wp.exe%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3BNT%20AUTHORITY%5CSYSTEM%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3BDuplicateKeyException%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3BCannot%20add%20a%20duplicate%20key.%20%20Use%20Insert%20instead%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.CacheReader.AddEntry(String%20userKey%2C%20Int32%20userPolicy%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyRepo.GetUserPolicy(String%20userKey%2C%20Int32%20traceId%2C%20Int32%26amp%3Bamp%3B%20userPolicy%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyEvaluator.IsBasicAuthAllowed(String%20userKey%2C%20String%20protocolName%2C%20Int32%20traceId%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.BackendRehydrationModule.IsLegacyAuthAllowed(HttpContext%20httpContext)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.BackendRehydrationModule.OnAuthenticateRequest(Object%20source%2C%20EventArgs%20args)%0A%20%20%20at%20System.Web.HttpApplication.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()%0A%20%20%20at%20System.Web.HttpApplication.ExecuteStepImpl(IExecutionStep%20step)%0A%20%20%20at%20System.Web.HttpApplication.ExecuteStep(IExecutionStep%20step%2C%20Boolean%26amp%3Bamp%3B%20completedSynchronously)%0A%0A%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3Bhttps%3A%2F%2F%26lt%3Bcomputer%20name%26gt%3B.%26lt%3Bdomain%26gt%3B.com%3A444%2FEWS%2FExchange.asmx%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3B%2FEWS%2FExchange.asmx%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3B%26lt%3Binternal%20ip%26gt%3B%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3B%26lt%3Bdomain%26gt%3B%5C%26lt%3Bcomputer%20name%26gt%3B%24%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3BTrue%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3BNegotiate%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3BNT%20AUTHORITY%5CSYSTEM%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3B11%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3BNT%20AUTHORITY%5CSYSTEM%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3BFalse%26lt%3B%2FData%26gt%3B%0A%20%20%20%20%26lt%3BData%26gt%3B%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.CacheReader.AddEntry(String%20userKey%2C%20Int32%20userPolicy%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyRepo.GetUserPolicy(String%20userKey%2C%20Int32%20traceId%2C%20Int32%26amp%3Bamp%3B%20userPolicy%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.FederatedAuthService.BasicAuthPolicyEvaluator.IsBasicAuthAllowed(String%20userKey%2C%20String%20protocolName%2C%20Int32%20traceId%2C%20HttpApplication%20httpApplication%2C%20IRecipientSession%20recipientSession%2C%20IConfigurationSession%20configSession%2C%20ConfigWrapper%20config)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.BackendRehydrationModule.IsLegacyAuthAllowed(HttpContext%20httpContext)%0A%20%20%20at%20Microsoft.Exchange.Security.Authentication.BackendRehydrationModule.OnAuthenticateRequest(Object%20source%2C%20EventArgs%20args)%0A%20%20%20at%20System.Web.HttpApplication.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()%0A%20%20%20at%20System.Web.HttpApplication.ExecuteStepImpl(IExecutionStep%20step)%0A%20%20%20at%20System.Web.HttpApplication.ExecuteStep(IExecutionStep%20step%2C%20Boolean%26amp%3Bamp%3B%20completedSynchronously)%0A%26lt%3B%2FData%26gt%3B%0A%20%20%26lt%3B%2FEventData%26gt%3B%0A%26lt%3B%2FEvent%26gt%3B%3C%2FPRE%3E%3C%2FDIV%3E%3C%2FDIV%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1977364%22%20slang%3D%22en-US%22%3ERe%3A%20Disabling%20Legacy%20Authentication%20in%20Exchange%20Server%202019%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1977364%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F894238%22%20target%3D%22_blank%22%3E%40skreel%3C%2FA%3E%26nbsp%3B-%20open%20a%20support%20case.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2023226%22%20slang%3D%22en-US%22%3ERe%3A%20Disabling%20Legacy%20Authentication%20in%20Exchange%20Server%202019%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2023226%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F149115%22%20target%3D%22_blank%22%3E%40Greg%20Taylor%20-%20EXCHANGE%3C%2FA%3E%26nbsp%3B%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F324116%22%20target%3D%22_blank%22%3E%40The_Exchange_Team%3C%2FA%3E%26nbsp%3BI%20opened%20a%20support%20case.%20They%20said%20they%20don't%20have%20a%20lot%20of%20experience%20with%20this...%20they're%20currently%20trying%20to%20ascertain%20if%20round%20robin%20DNS%20works%20for%20this...%20Should%20round%20robin%20DNS%20work%20as%20a%20front-end%20load%20balancing%20solution%20with%20legacy%20auth%20disabled%20at%20the%20org%20level%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20took%20memory%20dumps%20of%20a%20couple%20of%20the%20duplicate%20key%20exceptions%20but%20support%20says%20that%20they%20can't%20do%20anything%20with%20the%20dumps%20and%20they%20don't%20want%20them...%20I%20tried%20using%20windbg%20and%20SOS%20to%20figure%20it%20out%20on%20my%20own%20but%20without%20the%20symbols%20or%20source%20it's%20proving%20to%20be%20rather%20challenging%20for%20me...%20I%20don't%20think%20I'm%20going%20to%20get%20very%20far%20with%20support.%20They're%20saying%20we%20might%20just%20have%20to%20migrate%20all%20our%20mailboxes%20to%20the%20cloud...%20any%20help%20would%20be%20appreciated.%20Thanks!%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2033470%22%20slang%3D%22en-US%22%3ERe%3A%20Disabling%20Legacy%20Authentication%20in%20Exchange%20Server%202019%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2033470%22%20slang%3D%22en-US%22%3E%3CP%3EExceptions%20are%20showing%20up%20in%20the%20logs%20located%20at%20C%3A%5CProgram%20Files%5CMicrosoft%5CExchange%20Server%5CV15%5CLogging%5CHttpProxy%5CEas%20and%26nbsp%3BC%3A%5CProgram%20Files%5CMicrosoft%5CExchange%20Server%5CV15%5CLogging%5CHttpProxy%5CAutodiscover.%20I%20have%20not%20checked%20the%20other%20HttpProxy%20logs.%20Support%20is%20saying%20that%20no%20one%20uses%20this%20feature%20and%20that%20it's%20likely%20a%20problem%20with%20the%20code.%20I've%20been%20advised%20to%20just%20not%20disable%20legacy%20auth%20at%20the%20org%20level%20on%20premise%20and%20to%20either%20move%20the%20mailboxes%20to%20the%20cloud%20or%20to%20just%20disable%20legacy%20auth%20on%20a%20per%20user%20basis...%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2041617%22%20slang%3D%22en-US%22%3ERe%3A%20Disabling%20Legacy%20Authentication%20in%20Exchange%20Server%202019%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2041617%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F894238%22%20target%3D%22_blank%22%3E%40skreel%3C%2FA%3E%26nbsp%3B-%20can%20you%20please%20send%20me%20the%20case%20number%20in%20a%20private%20message.%20Thanks.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2045742%22%20slang%3D%22en-US%22%3ERe%3A%20Disabling%20Legacy%20Authentication%20in%20Exchange%20Server%202019%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2045742%22%20slang%3D%22en-US%22%3E%3CP%3EThe%20issue%20seems%20to%20be%20that%20when%20requests%20are%20proxied%20between%20nodes%20then%20legacy%20authentication%20needs%20to%20be%20enabled.%20When%20you%20disable%20legacy%20auth%20at%20the%20org%20level%20it%20also%20disables%20legacy%20auth%20for%20the%20proxying%20connection.%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CSTRONG%3EThe%20solution%20is%20to%20enable%20legacy%20auth%20on%20the%20computer%20accounts%20of%20the%20exchange%20servers.%26nbsp%3B%3CSPAN%3E%3CA%20href%3D%22http%3A%2F%2Fkreelbits.blogspot.com%2F2021%2F01%2Fdisabling-legacy-authentication-in.html%22%20target%3D%22_self%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3EI%20wrote%20up%20how%20to%20do%20this%20on%20my%20blog.%3C%2FA%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FSTRONG%3EIt's%20a%20hack%20though%20and%20I%20doubt%20it's%20supported%20by%20Microsoft.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2046841%22%20slang%3D%22en-US%22%3ERe%3A%20Disabling%20Legacy%20Authentication%20in%20Exchange%20Server%202019%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2046841%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F894238%22%20target%3D%22_blank%22%3E%40skreel%3C%2FA%3E%26nbsp%3B-%20it's%20a%20workaround%2C%20but%20we%20really%20need%20to%20fix%20this.%20I'll%20keep%20pushing.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2048624%22%20slang%3D%22en-US%22%3ERe%3A%20Disabling%20Legacy%20Authentication%20in%20Exchange%20Server%202019%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2048624%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F894238%22%20target%3D%22_blank%22%3E%40skreel%3C%2FA%3E%26nbsp%3BThanks%20for%20your%20contribution.%3CBR%20%2F%3E%3CBR%20%2F%3EI%20was%20suffering%20from%20the%20same%20problem%2C%20no%20proxy%20between%20servers%20when%20default%20org%20policy%20sets%20to%20%22Block%20Legacy%20Auth%22.%3CBR%20%2F%3EWorkaround%20as%20suggested%20on%20your%20blog%20was%20editing%20computer%20auth%20policy%20attribute%20thru%20ADSI%20on%20Exchange%20Servers%20computer%20accounts%20object%2C%20it%20makes%20everything%20working%20well%20from%20client%20side.%3CBR%20%2F%3EServer%20side%20%22%3CSPAN%3EUnhandled%20exceptions%22%20keeps%20appearing%20to%20my%20environment%20on%20event%20viewer.%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2049101%22%20slang%3D%22en-US%22%3ERe%3A%20Disabling%20Legacy%20Authentication%20in%20Exchange%20Server%202019%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2049101%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F762087%22%20target%3D%22_blank%22%3E%40bbzome%3C%2FA%3E%26nbsp%3Byeah%2C%20it%20seems%20like%20this%20is%20only%20a%20partial%20workaround.%20Those%20unhandled%20duplicate%20key%20exceptions%20on%20the%20server%20still%20occur.%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F149115%22%20target%3D%22_blank%22%3E%40Greg%20Taylor%20-%20EXCHANGE%3C%2FA%3E%26nbsp%3Bdo%20you%20think%20it's%20safe%20to%20run%20with%20the%20workaround%20or%20should%20we%20hold%20off%20for%20an%20official%20fix%3F%20Thanks!%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2049314%22%20slang%3D%22en-US%22%3ERe%3A%20Disabling%20Legacy%20Authentication%20in%20Exchange%20Server%202019%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2049314%22%20slang%3D%22en-US%22%3E%3CP%3EHonestly%2C%20no.%20That%20sounds%20like%20a%20bad%20idea.%20Your%20idea%20of%20using%20per-account%20rather%20than%20org%20settings%20until%20we%20fix%20it%20sounds%20far%20more%20sensible.%20Engineering%20are%20looking%20at%20it.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2075961%22%20slang%3D%22en-US%22%3ERe%3A%20Disabling%20Legacy%20Authentication%20in%20Exchange%20Server%202019%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2075961%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F149115%22%20target%3D%22_blank%22%3E%40Greg%20Taylor%20-%20EXCHANGE%3C%2FA%3E%26nbsp%3B%2C%20we%20are%20experiencing%20the%20same%20problem%20as%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F894238%22%20target%3D%22_blank%22%3E%40skreel%3C%2FA%3E.%20We%20tested%20with%20individual%20users%20first%20and%20then%20applied%20it%20at%20the%20org%20level%20and%20immediately%20started%20having%20the%20flashing%20problem%20and%20we%20had%20to%20revert%20and%20set%20the%20default%20at%20the%20org%20level%20as%20%24null.%20We%20have%203%20different%20DAG's%2C%20front%20ended%20by%20Load%20Balancers.%20Is%20the%20recommendation%20to%20still%20apply%20it%20at%20the%20user%20level%20instead%20of%20at%20the%20org%20level%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2087577%22%20slang%3D%22en-US%22%3ERe%3A%20Disabling%20Legacy%20Authentication%20in%20Exchange%20Server%202019%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2087577%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F935029%22%20target%3D%22_blank%22%3E%40cdbrown%3C%2FA%3E%26nbsp%3BI%20haven't%20heard%20any%20guidance%20otherwise%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2098761%22%20slang%3D%22en-US%22%3ERe%3A%20Disabling%20Legacy%20Authentication%20in%20Exchange%20Server%202019%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2098761%22%20slang%3D%22en-US%22%3E%3CP%3EThe%20engineering%20team%20have%20agreed%20to%20fix%20this%2C%20but%20it's%20not%20going%20to%20ship%20for%20a%20CU%20or%20two%2C%20so%20until%20then%2C%20stick%20with%20per%20user%20policies.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2110034%22%20slang%3D%22en-US%22%3ERe%3A%20Disabling%20Legacy%20Authentication%20in%20Exchange%20Server%202019%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2110034%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F149115%22%20target%3D%22_blank%22%3E%40Greg%20Taylor%20-%20EXCHANGE%3C%2FA%3E%26nbsp%3Band%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F324116%22%20target%3D%22_blank%22%3E%40The_Exchange_Team%3C%2FA%3E%26nbsp%3Bwe%20have%20enabled%20HMA%20and%20things%20seems%20to%20run%20good.%20But%20when%20we%20set%20authentication%20policy%20(pr%20user)%20we%20see%20some%20issues%20with%20password%20dialog%20boxes%20(Windows%20login%20prompt).%3C%2FP%3E%3CP%3EWe%20have%20found%20out%20that%20it%20is%20related%20to%26nbsp%3B%3CSPAN%3EBlockLegacyAuthMapi%20but%20ONLY%20if%20the%20client%20is%20on%20DirectAccess.%20If%20we%20disconnect%20DirectAccess%20everything%20seems%20to%20run%20smooth%20as%20well%20as%20if%20do%20it%20from%20a%20virtual%20client%20not%20connected%20to%20Direct%20Access.%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3EWe%20have%202%20Exchange%202019%20servers%20in%20DAG%20on%20CU8%20with%20Big%20IP%20F5%20loadmaster.%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3EAny%20suggestions%3F%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2116946%22%20slang%3D%22en-US%22%3ERe%3A%20Disabling%20Legacy%20Authentication%20in%20Exchange%20Server%202019%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2116946%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F887682%22%20target%3D%22_blank%22%3E%40MrKnazure%3C%2FA%3E%26nbsp%3Bthanks%20for%20the%20feedback.%20It's%20been%20added%20to%20the%20notes%20for%20the%20issue%20being%20investigated.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2182713%22%20slang%3D%22en-US%22%3ERe%3A%20Disabling%20Legacy%20Authentication%20in%20Exchange%20Server%202019%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2182713%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F149115%22%20target%3D%22_blank%22%3E%40Greg%20Taylor%20-%20EXCHANGE%3C%2FA%3E%26nbsp%3BIf%20we%20have%20all%20user%20mailboxes%20hosted%20on%20Exchange%202016%2C%20and%20have%20deployed%20Exchange%202019%2C%20can%20we%20safely%20enable%20the%20default%20Authentication%20policy%20for%20the%20Org%2C%20without%20effecting%20any%20user%20mailboxes%20that%20are%20hosted%20on%20Exchange%202016%3F%3C%2FP%3E%3CPRE%3ESet-OrganizationConfig%20-DefaultAuthenticationPolicy%20%22Block%20Legacy%20Auth%22%3C%2FPRE%3E%3CP%3ECan%20we%20then%20slowly%20start%20migrating%20users%20over%20to%20Exchange%202019%20while%20blocking%20legacy%20auth%20for%20only%20those%20mailboxes%20migrated%20over%20to%20Exchange%202019%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EShould%20we%20wait%20until%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F324116%22%20target%3D%22_blank%22%3E%40The_Exchange_Team%3C%2FA%3E%26nbsp%3B%20fixes%20the%20default%20org%20config%20before%20moving%20forward%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2183103%22%20slang%3D%22en-US%22%3ERe%3A%20Disabling%20Legacy%20Authentication%20in%20Exchange%20Server%202019%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2183103%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F3987%22%20target%3D%22_blank%22%3E%40Rob%20Whaley%20(EXCHANGE)%3C%2FA%3E%26nbsp%3B-%20I%20believe%20the%20answer%20to%20this%20is%20yes%2C%20do%20you%20concur%3F%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2183336%22%20slang%3D%22en-US%22%3ERe%3A%20Disabling%20Legacy%20Authentication%20in%20Exchange%20Server%202019%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2183336%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F985543%22%20target%3D%22_blank%22%3E%40Exchange_Admin%3C%2FA%3E%26nbsp%3B%20and%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F149115%22%20target%3D%22_blank%22%3E%40Greg%20Taylor%20-%20EXCHANGE%3C%2FA%3E%26nbsp%3BThat%20is%20correct%2C%20Exchange%202019%20Authentication%20Policies%20should%20only%20apply%20to%20mailboxes%20that%20are%20homed%20on%20an%20Exchange%202019%20server.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2241443%22%20slang%3D%22en-US%22%3ERe%3A%20Disabling%20Legacy%20Authentication%20in%20Exchange%20Server%202019%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2241443%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F149115%22%20target%3D%22_blank%22%3E%40Greg%20Taylor%20-%20EXCHANGE%3C%2FA%3E%26nbsp%3B%20%3A%20With%20the%20release%20of%20CU9%20KB5000631%20is%20marked%20to%20be%20fixed.%20Does%20this%20mean%20the%20Events%20mentioned%20in%20the%20KB%20are%20no%20more%20triggered%20or%20the%20issue%20with%20being%20unable%20to%20set%20HMA%20Policies%20on%20the%20Org%20level%20is%20fixed%20as%20well%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%20as%20always!%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2243019%22%20slang%3D%22en-US%22%3ERe%3A%20Disabling%20Legacy%20Authentication%20in%20Exchange%20Server%202019%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2243019%22%20slang%3D%22en-US%22%3E%3CP%3EI%20just%20checked%20with%20engineering%20and%20the%20answer%20is%20that%20yes%2C%20CU9%20fixes%20both%20problems.%20The%20policies%20should%20now%20work%20and%20no%20event%20errors%20should%20be%20generated.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
Version history
Last update:
‎Jul 01 2019 04:37 PM
Updated by: